drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
   9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  10  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  11  *
  12  * This program is free software; you can redistribute it and/or modify
  13  * it under the terms of version 2 of the GNU General Public License as
  14  * published by the Free Software Foundation.
  15  *
  16  * This program is distributed in the hope that it will be useful, but
  17  * WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  19  * General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  24  * USA
  25  *
  26  * The full GNU General Public License is included in this distribution
  27  * in the file called COPYING.
  28  *
  29  * Contact Information:
  30  *  Intel Linux Wireless <linuxwifi@intel.com>
  31  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  32  *
  33  * BSD LICENSE
  34  *
  35  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  36  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  37  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  38  * All rights reserved.
  39  *
  40  * Redistribution and use in source and binary forms, with or without
  41  * modification, are permitted provided that the following conditions
  42  * are met:
  43  *
  44  *  * Redistributions of source code must retain the above copyright
  45  *    notice, this list of conditions and the following disclaimer.
  46  *  * Redistributions in binary form must reproduce the above copyright
  47  *    notice, this list of conditions and the following disclaimer in
  48  *    the documentation and/or other materials provided with the
  49  *    distribution.
  50  *  * Neither the name Intel Corporation nor the names of its
  51  *    contributors may be used to endorse or promote products derived
  52  *    from this software without specific prior written permission.
  53  *
  54  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  55  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  56  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  57  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  58  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  59  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  60  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  61  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  62  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  63  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  64  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  65  *
  66  *****************************************************************************/
  67 #include <linux/kernel.h>
  68 #include <linux/slab.h>
  69 #include <linux/skbuff.h>
  70 #include <linux/netdevice.h>
  71 #include <linux/etherdevice.h>
  72 #include <linux/ip.h>
  73 #include <linux/if_arp.h>
  74 #include <linux/time.h>
  75 #include <net/mac80211.h>
  76 #include <net/ieee80211_radiotap.h>
  77 #include <net/tcp.h>
  78
  79 #include "iwl-op-mode.h"
  80 #include "iwl-io.h"
  81 #include "mvm.h"
  82 #include "sta.h"
  83 #include "time-event.h"
  84 #include "iwl-eeprom-parse.h"
  85 #include "iwl-phy-db.h"
  86 #include "testmode.h"
  87 #include "fw/error-dump.h"
  88 #include "iwl-prph.h"
  89 #include "iwl-nvm-parse.h"
  90
  91 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
  92         {
  93                 .max = 1,
  94                 .types = BIT(NL80211_IFTYPE_STATION),
  95         },
  96         {
  97                 .max = 1,
  98                 .types = BIT(NL80211_IFTYPE_AP) |
  99                         BIT(NL80211_IFTYPE_P2P_CLIENT) |
 100                         BIT(NL80211_IFTYPE_P2P_GO),
 101         },
 102         {
 103                 .max = 1,
 104                 .types = BIT(NL80211_IFTYPE_P2P_DEVICE),
 105         },
 106 };
 107
 108 static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
 109         {
 110                 .num_different_channels = 2,
 111                 .max_interfaces = 3,
 112                 .limits = iwl_mvm_limits,
 113                 .n_limits = ARRAY_SIZE(iwl_mvm_limits),
 114         },
 115 };
 116
 117 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 118 /*
 119  * Use the reserved field to indicate magic values.
 120  * these values will only be used internally by the driver,
 121  * and won't make it to the fw (reserved will be 0).
 122  * BC_FILTER_MAGIC_IP - configure the val of this attribute to
 123  *      be the vif's ip address. in case there is not a single
 124  *      ip address (0, or more than 1), this attribute will
 125  *      be skipped.
 126  * BC_FILTER_MAGIC_MAC - set the val of this attribute to
 127  *      the LSB bytes of the vif's mac address
 128  */
 129 enum {
 130         BC_FILTER_MAGIC_NONE = 0,
 131         BC_FILTER_MAGIC_IP,
 132         BC_FILTER_MAGIC_MAC,
 133 };
 134
 135 static const struct iwl_fw_bcast_filter iwl_mvm_default_bcast_filters[] = {
 136         {
 137                 /* arp */
 138                 .discard = 0,
 139                 .frame_type = BCAST_FILTER_FRAME_TYPE_ALL,
 140                 .attrs = {
 141                         {
 142                                 /* frame type - arp, hw type - ethernet */
 143                                 .offset_type =
 144                                         BCAST_FILTER_OFFSET_PAYLOAD_START,
 145                                 .offset = sizeof(rfc1042_header),
 146                                 .val = cpu_to_be32(0x08060001),
 147                                 .mask = cpu_to_be32(0xffffffff),
 148                         },
 149                         {
 150                                 /* arp dest ip */
 151                                 .offset_type =
 152                                         BCAST_FILTER_OFFSET_PAYLOAD_START,
 153                                 .offset = sizeof(rfc1042_header) + 2 +
 154                                           sizeof(struct arphdr) +
 155                                           ETH_ALEN + sizeof(__be32) +
 156                                           ETH_ALEN,
 157                                 .mask = cpu_to_be32(0xffffffff),
 158                                 /* mark it as special field */
 159                                 .reserved1 = cpu_to_le16(BC_FILTER_MAGIC_IP),
 160                         },
 161                 },
 162         },
 163         {
 164                 /* dhcp offer bcast */
 165                 .discard = 0,
 166                 .frame_type = BCAST_FILTER_FRAME_TYPE_IPV4,
 167                 .attrs = {
 168                         {
 169                                 /* udp dest port - 68 (bootp client)*/
 170                                 .offset_type = BCAST_FILTER_OFFSET_IP_END,
 171                                 .offset = offsetof(struct udphdr, dest),
 172                                 .val = cpu_to_be32(0x00440000),
 173                                 .mask = cpu_to_be32(0xffff0000),
 174                         },
 175                         {
 176                                 /* dhcp - lsb bytes of client hw address */
 177                                 .offset_type = BCAST_FILTER_OFFSET_IP_END,
 178                                 .offset = 38,
 179                                 .mask = cpu_to_be32(0xffffffff),
 180                                 /* mark it as special field */
 181                                 .reserved1 = cpu_to_le16(BC_FILTER_MAGIC_MAC),
 182                         },
 183                 },
 184         },
 185         /* last filter must be empty */
 186         {},
 187 };
 188 #endif
 189
 190 void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
 191 {
 192         if (!iwl_mvm_is_d0i3_supported(mvm))
 193                 return;
 194
 195         IWL_DEBUG_RPM(mvm, "Take mvm reference - type %d\n", ref_type);
 196         spin_lock_bh(&mvm->refs_lock);
 197         mvm->refs[ref_type]++;
 198         spin_unlock_bh(&mvm->refs_lock);
 199         iwl_trans_ref(mvm->trans);
 200 }
 201
 202 void iwl_mvm_unref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
 203 {
 204         if (!iwl_mvm_is_d0i3_supported(mvm))
 205                 return;
 206
 207         IWL_DEBUG_RPM(mvm, "Leave mvm reference - type %d\n", ref_type);
 208         spin_lock_bh(&mvm->refs_lock);
 209         if (WARN_ON(!mvm->refs[ref_type])) {
 210                 spin_unlock_bh(&mvm->refs_lock);
 211                 return;
 212         }
 213         mvm->refs[ref_type]--;
 214         spin_unlock_bh(&mvm->refs_lock);
 215         iwl_trans_unref(mvm->trans);
 216 }
 217
 218 static void iwl_mvm_unref_all_except(struct iwl_mvm *mvm,
 219                                      enum iwl_mvm_ref_type except_ref)
 220 {
 221         int i, j;
 222
 223         if (!iwl_mvm_is_d0i3_supported(mvm))
 224                 return;
 225
 226         spin_lock_bh(&mvm->refs_lock);
 227         for (i = 0; i < IWL_MVM_REF_COUNT; i++) {
 228                 if (except_ref == i || !mvm->refs[i])
 229                         continue;
 230
 231                 IWL_DEBUG_RPM(mvm, "Cleanup: remove mvm ref type %d (%d)\n",
 232                               i, mvm->refs[i]);
 233                 for (j = 0; j < mvm->refs[i]; j++)
 234                         iwl_trans_unref(mvm->trans);
 235                 mvm->refs[i] = 0;
 236         }
 237         spin_unlock_bh(&mvm->refs_lock);
 238 }
 239
 240 bool iwl_mvm_ref_taken(struct iwl_mvm *mvm)
 241 {
 242         int i;
 243         bool taken = false;
 244
 245         if (!iwl_mvm_is_d0i3_supported(mvm))
 246                 return true;
 247
 248         spin_lock_bh(&mvm->refs_lock);
 249         for (i = 0; i < IWL_MVM_REF_COUNT; i++) {
 250                 if (mvm->refs[i]) {
 251                         taken = true;
 252                         break;
 253                 }
 254         }
 255         spin_unlock_bh(&mvm->refs_lock);
 256
 257         return taken;
 258 }
 259
 260 int iwl_mvm_ref_sync(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
 261 {
 262         iwl_mvm_ref(mvm, ref_type);
 263
 264         if (!wait_event_timeout(mvm->d0i3_exit_waitq,
 265                                 !test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status),
 266                                 HZ)) {
 267                 WARN_ON_ONCE(1);
 268                 iwl_mvm_unref(mvm, ref_type);
 269                 return -EIO;
 270         }
 271
 272         return 0;
 273 }
 274
 275 static void iwl_mvm_reset_phy_ctxts(struct iwl_mvm *mvm)
 276 {
 277         int i;
 278
 279         memset(mvm->phy_ctxts, 0, sizeof(mvm->phy_ctxts));
 280         for (i = 0; i < NUM_PHY_CTX; i++) {
 281                 mvm->phy_ctxts[i].id = i;
 282                 mvm->phy_ctxts[i].ref = 0;
 283         }
 284 }
 285
 286 struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
 287                                                   const char *alpha2,
 288                                                   enum iwl_mcc_source src_id,
 289                                                   bool *changed)
 290 {
 291         struct ieee80211_regdomain *regd = NULL;
 292         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
 293         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 294         struct iwl_mcc_update_resp *resp;
 295
 296         IWL_DEBUG_LAR(mvm, "Getting regdomain data for %s from FW\n", alpha2);
 297
 298         lockdep_assert_held(&mvm->mutex);
 299
 300         resp = iwl_mvm_update_mcc(mvm, alpha2, src_id);
 301         if (IS_ERR_OR_NULL(resp)) {
 302                 IWL_DEBUG_LAR(mvm, "Could not get update from FW %d\n",
 303                               PTR_ERR_OR_ZERO(resp));
 304                 goto out;
 305         }
 306
 307         if (changed)
 308                 *changed = (resp->status == MCC_RESP_NEW_CHAN_PROFILE);
 309
 310         regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
 311                                       __le32_to_cpu(resp->n_channels),
 312                                       resp->channels,
 313                                       __le16_to_cpu(resp->mcc));
 314         /* Store the return source id */
 315         src_id = resp->source_id;
 316         kfree(resp);
 317         if (IS_ERR_OR_NULL(regd)) {
 318                 IWL_DEBUG_LAR(mvm, "Could not get parse update from FW %d\n",
 319                               PTR_ERR_OR_ZERO(regd));
 320                 goto out;
 321         }
 322
 323         IWL_DEBUG_LAR(mvm, "setting alpha2 from FW to %s (0x%x, 0x%x) src=%d\n",
 324                       regd->alpha2, regd->alpha2[0], regd->alpha2[1], src_id);
 325         mvm->lar_regdom_set = true;
 326         mvm->mcc_src = src_id;
 327
 328 out:
 329         return regd;
 330 }
 331
 332 void iwl_mvm_update_changed_regdom(struct iwl_mvm *mvm)
 333 {
 334         bool changed;
 335         struct ieee80211_regdomain *regd;
 336
 337         if (!iwl_mvm_is_lar_supported(mvm))
 338                 return;
 339
 340         regd = iwl_mvm_get_current_regdomain(mvm, &changed);
 341         if (!IS_ERR_OR_NULL(regd)) {
 342                 /* only update the regulatory core if changed */
 343                 if (changed)
 344                         regulatory_set_wiphy_regd(mvm->hw->wiphy, regd);
 345
 346                 kfree(regd);
 347         }
 348 }
 349
 350 struct ieee80211_regdomain *iwl_mvm_get_current_regdomain(struct iwl_mvm *mvm,
 351                                                           bool *changed)
 352 {
 353         return iwl_mvm_get_regdomain(mvm->hw->wiphy, "ZZ",
 354                                      iwl_mvm_is_wifi_mcc_supported(mvm) ?
 355                                      MCC_SOURCE_GET_CURRENT :
 356                                      MCC_SOURCE_OLD_FW, changed);
 357 }
 358
 359 int iwl_mvm_init_fw_regd(struct iwl_mvm *mvm)
 360 {
 361         enum iwl_mcc_source used_src;
 362         struct ieee80211_regdomain *regd;
 363         int ret;
 364         bool changed;
 365         const struct ieee80211_regdomain *r =
 366                         rtnl_dereference(mvm->hw->wiphy->regd);
 367
 368         if (!r)
 369                 return -ENOENT;
 370
 371         /* save the last source in case we overwrite it below */
 372         used_src = mvm->mcc_src;
 373         if (iwl_mvm_is_wifi_mcc_supported(mvm)) {
 374                 /* Notify the firmware we support wifi location updates */
 375                 regd = iwl_mvm_get_current_regdomain(mvm, NULL);
 376                 if (!IS_ERR_OR_NULL(regd))
 377                         kfree(regd);
 378         }
 379
 380         /* Now set our last stored MCC and source */
 381         regd = iwl_mvm_get_regdomain(mvm->hw->wiphy, r->alpha2, used_src,
 382                                      &changed);
 383         if (IS_ERR_OR_NULL(regd))
 384                 return -EIO;
 385
 386         /* update cfg80211 if the regdomain was changed */
 387         if (changed)
 388                 ret = regulatory_set_wiphy_regd_sync_rtnl(mvm->hw->wiphy, regd);
 389         else
 390                 ret = 0;
 391
 392         kfree(regd);
 393         return ret;
 394 }
 395
 396 int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
 397 {
 398         struct ieee80211_hw *hw = mvm->hw;
 399         int num_mac, ret, i;
 400         static const u32 mvm_ciphers[] = {
 401                 WLAN_CIPHER_SUITE_WEP40,
 402                 WLAN_CIPHER_SUITE_WEP104,
 403                 WLAN_CIPHER_SUITE_TKIP,
 404                 WLAN_CIPHER_SUITE_CCMP,
 405         };
 406
 407         /* Tell mac80211 our characteristics */
 408         ieee80211_hw_set(hw, SIGNAL_DBM);
 409         ieee80211_hw_set(hw, SPECTRUM_MGMT);
 410         ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
 411         ieee80211_hw_set(hw, QUEUE_CONTROL);
 412         ieee80211_hw_set(hw, WANT_MONITOR_VIF);
 413         ieee80211_hw_set(hw, SUPPORTS_PS);
 414         ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
 415         ieee80211_hw_set(hw, AMPDU_AGGREGATION);
 416         ieee80211_hw_set(hw, TIMING_BEACON_ONLY);
 417         ieee80211_hw_set(hw, CONNECTION_MONITOR);
 418         ieee80211_hw_set(hw, CHANCTX_STA_CSA);
 419         ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
 420         ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
 421         ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
 422         ieee80211_hw_set(hw, NEEDS_UNIQUE_STA_ADDR);
 423         if (iwl_mvm_has_new_rx_api(mvm))
 424                 ieee80211_hw_set(hw, SUPPORTS_REORDERING_BUFFER);
 425
 426         if (fw_has_capa(&mvm->fw->ucode_capa,
 427                         IWL_UCODE_TLV_CAPA_STA_PM_NOTIF)) {
 428                 ieee80211_hw_set(hw, AP_LINK_PS);
 429         } else if (WARN_ON(iwl_mvm_has_new_tx_api(mvm))) {
 430                 /*
 431                  * we absolutely need this for the new TX API since that comes
 432                  * with many more queues than the current code can deal with
 433                  * for station powersave
 434                  */
 435                 return -EINVAL;
 436         }
 437
 438         if (mvm->trans->num_rx_queues > 1)
 439                 ieee80211_hw_set(hw, USES_RSS);
 440
 441         if (mvm->trans->max_skb_frags)
 442                 hw->netdev_features = NETIF_F_HIGHDMA | NETIF_F_SG;
 443
 444         hw->queues = IEEE80211_MAX_QUEUES;
 445         hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
 446         hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FEC |
 447                                     IEEE80211_RADIOTAP_MCS_HAVE_STBC;
 448         hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC |
 449                 IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED;
 450
 451         hw->radiotap_timestamp.units_pos =
 452                 IEEE80211_RADIOTAP_TIMESTAMP_UNIT_US |
 453                 IEEE80211_RADIOTAP_TIMESTAMP_SPOS_PLCP_SIG_ACQ;
 454         /* this is the case for CCK frames, it's better (only 8) for OFDM */
 455         hw->radiotap_timestamp.accuracy = 22;
 456
 457         hw->rate_control_algorithm = "iwl-mvm-rs";
 458         hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
 459         hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
 460
 461         BUILD_BUG_ON(ARRAY_SIZE(mvm->ciphers) < ARRAY_SIZE(mvm_ciphers) + 6);
 462         memcpy(mvm->ciphers, mvm_ciphers, sizeof(mvm_ciphers));
 463         hw->wiphy->n_cipher_suites = ARRAY_SIZE(mvm_ciphers);
 464         hw->wiphy->cipher_suites = mvm->ciphers;
 465
 466         if (iwl_mvm_has_new_rx_api(mvm)) {
 467                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 468                         WLAN_CIPHER_SUITE_GCMP;
 469                 hw->wiphy->n_cipher_suites++;
 470                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 471                         WLAN_CIPHER_SUITE_GCMP_256;
 472                 hw->wiphy->n_cipher_suites++;
 473         }
 474
 475         /* Enable 11w if software crypto is not enabled (as the
 476          * firmware will interpret some mgmt packets, so enabling it
 477          * with software crypto isn't safe).
 478          */
 479         if (!iwlwifi_mod_params.swcrypto) {
 480                 ieee80211_hw_set(hw, MFP_CAPABLE);
 481                 mvm->ciphers[hw->wiphy->n_cipher_suites] =
 482                         WLAN_CIPHER_SUITE_AES_CMAC;
 483                 hw->wiphy->n_cipher_suites++;
 484                 if (iwl_mvm_has_new_rx_api(mvm)) {
 485                         mvm->ciphers[hw->wiphy->n_cipher_suites] =
 486                                 WLAN_CIPHER_SUITE_BIP_GMAC_128;
 487                         hw->wiphy->n_cipher_suites++;
 488                         mvm->ciphers[hw->wiphy->n_cipher_suites] =
 489                                 WLAN_CIPHER_SUITE_BIP_GMAC_256;
 490                         hw->wiphy->n_cipher_suites++;
 491                 }
 492         }
 493
 494         /* currently FW API supports only one optional cipher scheme */
 495         if (mvm->fw->cs[0].cipher) {
 496                 const struct iwl_fw_cipher_scheme *fwcs = &mvm->fw->cs[0];
 497                 struct ieee80211_cipher_scheme *cs = &mvm->cs[0];
 498
 499                 mvm->hw->n_cipher_schemes = 1;
 500
 501                 cs->cipher = le32_to_cpu(fwcs->cipher);
 502                 cs->iftype = BIT(NL80211_IFTYPE_STATION);
 503                 cs->hdr_len = fwcs->hdr_len;
 504                 cs->pn_len = fwcs->pn_len;
 505                 cs->pn_off = fwcs->pn_off;
 506                 cs->key_idx_off = fwcs->key_idx_off;
 507                 cs->key_idx_mask = fwcs->key_idx_mask;
 508                 cs->key_idx_shift = fwcs->key_idx_shift;
 509                 cs->mic_len = fwcs->mic_len;
 510
 511                 mvm->hw->cipher_schemes = mvm->cs;
 512                 mvm->ciphers[hw->wiphy->n_cipher_suites] = cs->cipher;
 513                 hw->wiphy->n_cipher_suites++;
 514         }
 515
 516         ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
 517         hw->wiphy->features |=
 518                 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
 519                 NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR |
 520                 NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
 521
 522         hw->sta_data_size = sizeof(struct iwl_mvm_sta);
 523         hw->vif_data_size = sizeof(struct iwl_mvm_vif);
 524         hw->chanctx_data_size = sizeof(u16);
 525
 526         hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
 527                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
 528                 BIT(NL80211_IFTYPE_AP) |
 529                 BIT(NL80211_IFTYPE_P2P_GO) |
 530                 BIT(NL80211_IFTYPE_P2P_DEVICE) |
 531                 BIT(NL80211_IFTYPE_ADHOC);
 532
 533         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
 534         hw->wiphy->regulatory_flags |= REGULATORY_ENABLE_RELAX_NO_IR;
 535         if (iwl_mvm_is_lar_supported(mvm))
 536                 hw->wiphy->regulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED;
 537         else
 538                 hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
 539                                                REGULATORY_DISABLE_BEACON_HINTS;
 540
 541         hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 542         hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 543
 544         hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
 545         hw->wiphy->n_iface_combinations =
 546                 ARRAY_SIZE(iwl_mvm_iface_combinations);
 547
 548         hw->wiphy->max_remain_on_channel_duration = 10000;
 549         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
 550         /* we can compensate an offset of up to 3 channels = 15 MHz */
 551         hw->wiphy->max_adj_channel_rssi_comp = 3 * 5;
 552
 553         /* Extract MAC address */
 554         memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
 555         hw->wiphy->addresses = mvm->addresses;
 556         hw->wiphy->n_addresses = 1;
 557
 558         /* Extract additional MAC addresses if available */
 559         num_mac = (mvm->nvm_data->n_hw_addrs > 1) ?
 560                 min(IWL_MVM_MAX_ADDRESSES, mvm->nvm_data->n_hw_addrs) : 1;
 561
 562         for (i = 1; i < num_mac; i++) {
 563                 memcpy(mvm->addresses[i].addr, mvm->addresses[i-1].addr,
 564                        ETH_ALEN);
 565                 mvm->addresses[i].addr[5]++;
 566                 hw->wiphy->n_addresses++;
 567         }
 568
 569         iwl_mvm_reset_phy_ctxts(mvm);
 570
 571         hw->wiphy->max_scan_ie_len = iwl_mvm_max_scan_ie_len(mvm);
 572
 573         hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
 574
 575         BUILD_BUG_ON(IWL_MVM_SCAN_STOPPING_MASK & IWL_MVM_SCAN_MASK);
 576         BUILD_BUG_ON(IWL_MVM_MAX_UMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK) ||
 577                      IWL_MVM_MAX_LMAC_SCANS > HWEIGHT32(IWL_MVM_SCAN_MASK));
 578
 579         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
 580                 mvm->max_scans = IWL_MVM_MAX_UMAC_SCANS;
 581         else
 582                 mvm->max_scans = IWL_MVM_MAX_LMAC_SCANS;
 583
 584         if (mvm->nvm_data->bands[NL80211_BAND_2GHZ].n_channels)
 585                 hw->wiphy->bands[NL80211_BAND_2GHZ] =
 586                         &mvm->nvm_data->bands[NL80211_BAND_2GHZ];
 587         if (mvm->nvm_data->bands[NL80211_BAND_5GHZ].n_channels) {
 588                 hw->wiphy->bands[NL80211_BAND_5GHZ] =
 589                         &mvm->nvm_data->bands[NL80211_BAND_5GHZ];
 590
 591                 if (fw_has_capa(&mvm->fw->ucode_capa,
 592                                 IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
 593                     fw_has_api(&mvm->fw->ucode_capa,
 594                                IWL_UCODE_TLV_API_LQ_SS_PARAMS))
 595                         hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap |=
 596                                 IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
 597         }
 598
 599         hw->wiphy->hw_version = mvm->trans->hw_id;
 600
 601         if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
 602                 hw->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
 603         else
 604                 hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 605
 606         hw->wiphy->max_sched_scan_reqs = 1;
 607         hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
 608         hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
 609         /* we create the 802.11 header and zero length SSID IE. */
 610         hw->wiphy->max_sched_scan_ie_len =
 611                 SCAN_OFFLOAD_PROBE_REQ_SIZE - 24 - 2;
 612         hw->wiphy->max_sched_scan_plans = IWL_MAX_SCHED_SCAN_PLANS;
 613         hw->wiphy->max_sched_scan_plan_interval = U16_MAX;
 614
 615         /*
 616          * the firmware uses u8 for num of iterations, but 0xff is saved for
 617          * infinite loop, so the maximum number of iterations is actually 254.
 618          */
 619         hw->wiphy->max_sched_scan_plan_iterations = 254;
 620
 621         hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
 622                                NL80211_FEATURE_LOW_PRIORITY_SCAN |
 623                                NL80211_FEATURE_P2P_GO_OPPPS |
 624                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
 625                                NL80211_FEATURE_DYNAMIC_SMPS |
 626                                NL80211_FEATURE_STATIC_SMPS |
 627                                NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
 628
 629         if (fw_has_capa(&mvm->fw->ucode_capa,
 630                         IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT))
 631                 hw->wiphy->features |= NL80211_FEATURE_TX_POWER_INSERTION;
 632         if (fw_has_capa(&mvm->fw->ucode_capa,
 633                         IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT))
 634                 hw->wiphy->features |= NL80211_FEATURE_QUIET;
 635
 636         if (fw_has_capa(&mvm->fw->ucode_capa,
 637                         IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT))
 638                 hw->wiphy->features |=
 639                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES;
 640
 641         if (fw_has_capa(&mvm->fw->ucode_capa,
 642                         IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT))
 643                 hw->wiphy->features |= NL80211_FEATURE_WFA_TPC_IE_IN_PROBES;
 644
 645         if (fw_has_api(&mvm->fw->ucode_capa,
 646                        IWL_UCODE_TLV_API_SCAN_TSF_REPORT)) {
 647                 wiphy_ext_feature_set(hw->wiphy,
 648                                       NL80211_EXT_FEATURE_SCAN_START_TIME);
 649                 wiphy_ext_feature_set(hw->wiphy,
 650                                       NL80211_EXT_FEATURE_BSS_PARENT_TSF);
 651                 wiphy_ext_feature_set(hw->wiphy,
 652                                       NL80211_EXT_FEATURE_SET_SCAN_DWELL);
 653         }
 654
 655         mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
 656
 657 #ifdef CONFIG_PM_SLEEP
 658         if (iwl_mvm_is_d0i3_supported(mvm) &&
 659             device_can_wakeup(mvm->trans->dev)) {
 660                 mvm->wowlan.flags = WIPHY_WOWLAN_ANY;
 661                 hw->wiphy->wowlan = &mvm->wowlan;
 662         }
 663
 664         if (mvm->fw->img[IWL_UCODE_WOWLAN].num_sec &&
 665             mvm->trans->ops->d3_suspend &&
 666             mvm->trans->ops->d3_resume &&
 667             device_can_wakeup(mvm->trans->dev)) {
 668                 mvm->wowlan.flags |= WIPHY_WOWLAN_MAGIC_PKT |
 669                                      WIPHY_WOWLAN_DISCONNECT |
 670                                      WIPHY_WOWLAN_EAP_IDENTITY_REQ |
 671                                      WIPHY_WOWLAN_RFKILL_RELEASE |
 672                                      WIPHY_WOWLAN_NET_DETECT;
 673                 if (!iwlwifi_mod_params.swcrypto)
 674                         mvm->wowlan.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY |
 675                                              WIPHY_WOWLAN_GTK_REKEY_FAILURE |
 676                                              WIPHY_WOWLAN_4WAY_HANDSHAKE;
 677
 678                 mvm->wowlan.n_patterns = IWL_WOWLAN_MAX_PATTERNS;
 679                 mvm->wowlan.pattern_min_len = IWL_WOWLAN_MIN_PATTERN_LEN;
 680                 mvm->wowlan.pattern_max_len = IWL_WOWLAN_MAX_PATTERN_LEN;
 681                 mvm->wowlan.max_nd_match_sets = IWL_SCAN_MAX_PROFILES;
 682                 hw->wiphy->wowlan = &mvm->wowlan;
 683         }
 684 #endif
 685
 686 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 687         /* assign default bcast filtering configuration */
 688         mvm->bcast_filters = iwl_mvm_default_bcast_filters;
 689 #endif
 690
 691         ret = iwl_mvm_leds_init(mvm);
 692         if (ret)
 693                 return ret;
 694
 695         if (fw_has_capa(&mvm->fw->ucode_capa,
 696                         IWL_UCODE_TLV_CAPA_TDLS_SUPPORT)) {
 697                 IWL_DEBUG_TDLS(mvm, "TDLS supported\n");
 698                 hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
 699                 ieee80211_hw_set(hw, TDLS_WIDER_BW);
 700         }
 701
 702         if (fw_has_capa(&mvm->fw->ucode_capa,
 703                         IWL_UCODE_TLV_CAPA_TDLS_CHANNEL_SWITCH)) {
 704                 IWL_DEBUG_TDLS(mvm, "TDLS channel switch supported\n");
 705                 hw->wiphy->features |= NL80211_FEATURE_TDLS_CHANNEL_SWITCH;
 706         }
 707
 708         hw->netdev_features |= mvm->cfg->features;
 709         if (!iwl_mvm_is_csum_supported(mvm)) {
 710                 hw->netdev_features &= ~(IWL_TX_CSUM_NETIF_FLAGS |
 711                                          NETIF_F_RXCSUM);
 712                 /* We may support SW TX CSUM */
 713                 if (IWL_MVM_SW_TX_CSUM_OFFLOAD)
 714                         hw->netdev_features |= IWL_TX_CSUM_NETIF_FLAGS;
 715         }
 716
 717         ret = ieee80211_register_hw(mvm->hw);
 718         if (ret)
 719                 iwl_mvm_leds_exit(mvm);
 720         mvm->init_status |= IWL_MVM_INIT_STATUS_REG_HW_INIT_COMPLETE;
 721
 722         if (mvm->cfg->vht_mu_mimo_supported)
 723                 wiphy_ext_feature_set(hw->wiphy,
 724                                       NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
 725
 726         return ret;
 727 }
 728
 729 static bool iwl_mvm_defer_tx(struct iwl_mvm *mvm,
 730                              struct ieee80211_sta *sta,
 731                              struct sk_buff *skb)
 732 {
 733         struct iwl_mvm_sta *mvmsta;
 734         bool defer = false;
 735
 736         /*
 737          * double check the IN_D0I3 flag both before and after
 738          * taking the spinlock, in order to prevent taking
 739          * the spinlock when not needed.
 740          */
 741         if (likely(!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status)))
 742                 return false;
 743
 744         spin_lock(&mvm->d0i3_tx_lock);
 745         /*
 746          * testing the flag again ensures the skb dequeue
 747          * loop (on d0i3 exit) hasn't run yet.
 748          */
 749         if (!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status))
 750                 goto out;
 751
 752         mvmsta = iwl_mvm_sta_from_mac80211(sta);
 753         if (mvmsta->sta_id == IWL_MVM_INVALID_STA ||
 754             mvmsta->sta_id != mvm->d0i3_ap_sta_id)
 755                 goto out;
 756
 757         __skb_queue_tail(&mvm->d0i3_tx, skb);
 758         ieee80211_stop_queues(mvm->hw);
 759
 760         /* trigger wakeup */
 761         iwl_mvm_ref(mvm, IWL_MVM_REF_TX);
 762         iwl_mvm_unref(mvm, IWL_MVM_REF_TX);
 763
 764         defer = true;
 765 out:
 766         spin_unlock(&mvm->d0i3_tx_lock);
 767         return defer;
 768 }
 769
 770 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
 771                            struct ieee80211_tx_control *control,
 772                            struct sk_buff *skb)
 773 {
 774         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 775         struct ieee80211_sta *sta = control->sta;
 776         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 777         struct ieee80211_hdr *hdr = (void *)skb->data;
 778
 779         if (iwl_mvm_is_radio_killed(mvm)) {
 780                 IWL_DEBUG_DROP(mvm, "Dropping - RF/CT KILL\n");
 781                 goto drop;
 782         }
 783
 784         if (info->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE &&
 785             !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) &&
 786             !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
 787                 goto drop;
 788
 789         /* treat non-bufferable MMPDUs on AP interfaces as broadcast */
 790         if ((info->control.vif->type == NL80211_IFTYPE_AP ||
 791              info->control.vif->type == NL80211_IFTYPE_ADHOC) &&
 792             ieee80211_is_mgmt(hdr->frame_control) &&
 793             !ieee80211_is_bufferable_mmpdu(hdr->frame_control))
 794                 sta = NULL;
 795
 796         if (sta) {
 797                 if (iwl_mvm_defer_tx(mvm, sta, skb))
 798                         return;
 799                 if (iwl_mvm_tx_skb(mvm, skb, sta))
 800                         goto drop;
 801                 return;
 802         }
 803
 804         if (iwl_mvm_tx_skb_non_sta(mvm, skb))
 805                 goto drop;
 806         return;
 807  drop:
 808         ieee80211_free_txskb(hw, skb);
 809 }
 810
 811 static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg)
 812 {
 813         if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
 814                 return false;
 815         return true;
 816 }
 817
 818 static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg)
 819 {
 820         if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
 821                 return false;
 822         if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG)
 823                 return true;
 824
 825         /* enabled by default */
 826         return true;
 827 }
 828
 829 #define CHECK_BA_TRIGGER(_mvm, _trig, _tid_bm, _tid, _fmt...)           \
 830         do {                                                            \
 831                 if (!(le16_to_cpu(_tid_bm) & BIT(_tid)))                \
 832                         break;                                          \
 833                 iwl_fw_dbg_collect_trig(&(_mvm)->fwrt, _trig, _fmt);    \
 834         } while (0)
 835
 836 static void
 837 iwl_mvm_ampdu_check_trigger(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 838                             struct ieee80211_sta *sta, u16 tid, u16 rx_ba_ssn,
 839                             enum ieee80211_ampdu_mlme_action action)
 840 {
 841         struct iwl_fw_dbg_trigger_tlv *trig;
 842         struct iwl_fw_dbg_trigger_ba *ba_trig;
 843
 844         if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_BA))
 845                 return;
 846
 847         trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_BA);
 848         ba_trig = (void *)trig->data;
 849
 850         if (!iwl_fw_dbg_trigger_check_stop(&mvm->fwrt,
 851                                            ieee80211_vif_to_wdev(vif), trig))
 852                 return;
 853
 854         switch (action) {
 855         case IEEE80211_AMPDU_TX_OPERATIONAL: {
 856                 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 857                 struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
 858
 859                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_start, tid,
 860                                  "TX AGG START: MAC %pM tid %d ssn %d\n",
 861                                  sta->addr, tid, tid_data->ssn);
 862                 break;
 863                 }
 864         case IEEE80211_AMPDU_TX_STOP_CONT:
 865                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->tx_ba_stop, tid,
 866                                  "TX AGG STOP: MAC %pM tid %d\n",
 867                                  sta->addr, tid);
 868                 break;
 869         case IEEE80211_AMPDU_RX_START:
 870                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_start, tid,
 871                                  "RX AGG START: MAC %pM tid %d ssn %d\n",
 872                                  sta->addr, tid, rx_ba_ssn);
 873                 break;
 874         case IEEE80211_AMPDU_RX_STOP:
 875                 CHECK_BA_TRIGGER(mvm, trig, ba_trig->rx_ba_stop, tid,
 876                                  "RX AGG STOP: MAC %pM tid %d\n",
 877                                  sta->addr, tid);
 878                 break;
 879         default:
 880                 break;
 881         }
 882 }
 883
 884 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
 885                                     struct ieee80211_vif *vif,
 886                                     struct ieee80211_ampdu_params *params)
 887 {
 888         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 889         int ret;
 890         bool tx_agg_ref = false;
 891         struct ieee80211_sta *sta = params->sta;
 892         enum ieee80211_ampdu_mlme_action action = params->action;
 893         u16 tid = params->tid;
 894         u16 *ssn = &params->ssn;
 895         u8 buf_size = params->buf_size;
 896         bool amsdu = params->amsdu;
 897         u16 timeout = params->timeout;
 898
 899         IWL_DEBUG_HT(mvm, "A-MPDU action on addr %pM tid %d: action %d\n",
 900                      sta->addr, tid, action);
 901
 902         if (!(mvm->nvm_data->sku_cap_11n_enable))
 903                 return -EACCES;
 904
 905         /* return from D0i3 before starting a new Tx aggregation */
 906         switch (action) {
 907         case IEEE80211_AMPDU_TX_START:
 908         case IEEE80211_AMPDU_TX_STOP_CONT:
 909         case IEEE80211_AMPDU_TX_STOP_FLUSH:
 910         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
 911         case IEEE80211_AMPDU_TX_OPERATIONAL:
 912                 /*
 913                  * for tx start, wait synchronously until D0i3 exit to
 914                  * get the correct sequence number for the tid.
 915                  * additionally, some other ampdu actions use direct
 916                  * target access, which is not handled automatically
 917                  * by the trans layer (unlike commands), so wait for
 918                  * d0i3 exit in these cases as well.
 919                  */
 920                 ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_TX_AGG);
 921                 if (ret)
 922                         return ret;
 923
 924                 tx_agg_ref = true;
 925                 break;
 926         default:
 927                 break;
 928         }
 929
 930         mutex_lock(&mvm->mutex);
 931
 932         switch (action) {
 933         case IEEE80211_AMPDU_RX_START:
 934                 if (!iwl_enable_rx_ampdu(mvm->cfg)) {
 935                         ret = -EINVAL;
 936                         break;
 937                 }
 938                 ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, *ssn, true, buf_size,
 939                                          timeout);
 940                 break;
 941         case IEEE80211_AMPDU_RX_STOP:
 942                 ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false, buf_size,
 943                                          timeout);
 944                 break;
 945         case IEEE80211_AMPDU_TX_START:
 946                 if (!iwl_enable_tx_ampdu(mvm->cfg)) {
 947                         ret = -EINVAL;
 948                         break;
 949                 }
 950                 ret = iwl_mvm_sta_tx_agg_start(mvm, vif, sta, tid, ssn);
 951                 break;
 952         case IEEE80211_AMPDU_TX_STOP_CONT:
 953                 ret = iwl_mvm_sta_tx_agg_stop(mvm, vif, sta, tid);
 954                 break;
 955         case IEEE80211_AMPDU_TX_STOP_FLUSH:
 956         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
 957                 ret = iwl_mvm_sta_tx_agg_flush(mvm, vif, sta, tid);
 958                 break;
 959         case IEEE80211_AMPDU_TX_OPERATIONAL:
 960                 ret = iwl_mvm_sta_tx_agg_oper(mvm, vif, sta, tid,
 961                                               buf_size, amsdu);
 962                 break;
 963         default:
 964                 WARN_ON_ONCE(1);
 965                 ret = -EINVAL;
 966                 break;
 967         }
 968
 969         if (!ret) {
 970                 u16 rx_ba_ssn = 0;
 971
 972                 if (action == IEEE80211_AMPDU_RX_START)
 973                         rx_ba_ssn = *ssn;
 974
 975                 iwl_mvm_ampdu_check_trigger(mvm, vif, sta, tid,
 976                                             rx_ba_ssn, action);
 977         }
 978         mutex_unlock(&mvm->mutex);
 979
 980         /*
 981          * If the tid is marked as started, we won't use it for offloaded
 982          * traffic on the next D0i3 entry. It's safe to unref.
 983          */
 984         if (tx_agg_ref)
 985                 iwl_mvm_unref(mvm, IWL_MVM_REF_TX_AGG);
 986
 987         return ret;
 988 }
 989
 990 static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
 991                                      struct ieee80211_vif *vif)
 992 {
 993         struct iwl_mvm *mvm = data;
 994         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 995
 996         mvmvif->uploaded = false;
 997         mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
 998
 999         spin_lock_bh(&mvm->time_event_lock);
1000         iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
1001         spin_unlock_bh(&mvm->time_event_lock);
1002
1003         mvmvif->phy_ctxt = NULL;
1004         memset(&mvmvif->bf_data, 0, sizeof(mvmvif->bf_data));
1005 }
1006
1007 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
1008 {
1009         /* clear the D3 reconfig, we only need it to avoid dumping a
1010          * firmware coredump on reconfiguration, we shouldn't do that
1011          * on D3->D0 transition
1012          */
1013         if (!test_and_clear_bit(IWL_MVM_STATUS_D3_RECONFIG, &mvm->status)) {
1014                 mvm->fwrt.dump.desc = &iwl_dump_desc_assert;
1015                 iwl_fw_error_dump(&mvm->fwrt);
1016         }
1017
1018         /* cleanup all stale references (scan, roc), but keep the
1019          * ucode_down ref until reconfig is complete
1020          */
1021         iwl_mvm_unref_all_except(mvm, IWL_MVM_REF_UCODE_DOWN);
1022
1023         iwl_mvm_stop_device(mvm);
1024
1025         mvm->scan_status = 0;
1026         mvm->ps_disabled = false;
1027         mvm->calibrating = false;
1028
1029         /* just in case one was running */
1030         iwl_mvm_cleanup_roc_te(mvm);
1031         ieee80211_remain_on_channel_expired(mvm->hw);
1032
1033         /*
1034          * cleanup all interfaces, even inactive ones, as some might have
1035          * gone down during the HW restart
1036          */
1037         ieee80211_iterate_interfaces(mvm->hw, 0, iwl_mvm_cleanup_iterator, mvm);
1038
1039         mvm->p2p_device_vif = NULL;
1040         mvm->d0i3_ap_sta_id = IWL_MVM_INVALID_STA;
1041
1042         iwl_mvm_reset_phy_ctxts(mvm);
1043         memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
1044         memset(mvm->sta_deferred_frames, 0, sizeof(mvm->sta_deferred_frames));
1045         memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
1046         memset(&mvm->last_bt_ci_cmd, 0, sizeof(mvm->last_bt_ci_cmd));
1047
1048         ieee80211_wake_queues(mvm->hw);
1049
1050         /* clear any stale d0i3 state */
1051         clear_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status);
1052
1053         mvm->vif_count = 0;
1054         mvm->rx_ba_sessions = 0;
1055         mvm->fwrt.dump.conf = FW_DBG_INVALID;
1056         mvm->monitor_on = false;
1057
1058         /* keep statistics ticking */
1059         iwl_mvm_accu_radio_stats(mvm);
1060 }
1061
1062 int __iwl_mvm_mac_start(struct iwl_mvm *mvm)
1063 {
1064         int ret;
1065
1066         lockdep_assert_held(&mvm->mutex);
1067
1068         if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status)) {
1069                 /*
1070                  * Now convert the HW_RESTART_REQUESTED flag to IN_HW_RESTART
1071                  * so later code will - from now on - see that we're doing it.
1072                  */
1073                 set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1074                 clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
1075                 /* Clean up some internal and mac80211 state on restart */
1076                 iwl_mvm_restart_cleanup(mvm);
1077         } else {
1078                 /* Hold the reference to prevent runtime suspend while
1079                  * the start procedure runs.  It's a bit confusing
1080                  * that the UCODE_DOWN reference is taken, but it just
1081                  * means "UCODE is not UP yet". ( TODO: rename this
1082                  * reference).
1083                  */
1084                 iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
1085         }
1086         ret = iwl_mvm_up(mvm);
1087
1088         if (ret && test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1089                 /* Something went wrong - we need to finish some cleanup
1090                  * that normally iwl_mvm_mac_restart_complete() below
1091                  * would do.
1092                  */
1093                 clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1094                 iwl_mvm_d0i3_enable_tx(mvm, NULL);
1095         }
1096
1097         return ret;
1098 }
1099
1100 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
1101 {
1102         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1103         int ret;
1104
1105         /* Some hw restart cleanups must not hold the mutex */
1106         if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1107                 /*
1108                  * Make sure we are out of d0i3. This is needed
1109                  * to make sure the reference accounting is correct
1110                  * (and there is no stale d0i3_exit_work).
1111                  */
1112                 wait_event_timeout(mvm->d0i3_exit_waitq,
1113                                    !test_bit(IWL_MVM_STATUS_IN_D0I3,
1114                                              &mvm->status),
1115                                    HZ);
1116         }
1117
1118         mutex_lock(&mvm->mutex);
1119         ret = __iwl_mvm_mac_start(mvm);
1120         mutex_unlock(&mvm->mutex);
1121
1122         return ret;
1123 }
1124
1125 static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
1126 {
1127         int ret;
1128
1129         mutex_lock(&mvm->mutex);
1130
1131         clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
1132         iwl_mvm_d0i3_enable_tx(mvm, NULL);
1133         ret = iwl_mvm_update_quotas(mvm, true, NULL);
1134         if (ret)
1135                 IWL_ERR(mvm, "Failed to update quotas after restart (%d)\n",
1136                         ret);
1137
1138         /* allow transport/FW low power modes */
1139         iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
1140
1141         /*
1142          * If we have TDLS peers, remove them. We don't know the last seqno/PN
1143          * of packets the FW sent out, so we must reconnect.
1144          */
1145         iwl_mvm_teardown_tdls_peers(mvm);
1146
1147         mutex_unlock(&mvm->mutex);
1148 }
1149
1150 static void iwl_mvm_resume_complete(struct iwl_mvm *mvm)
1151 {
1152         if (iwl_mvm_is_d0i3_supported(mvm) &&
1153             iwl_mvm_enter_d0i3_on_suspend(mvm))
1154                 WARN_ONCE(!wait_event_timeout(mvm->d0i3_exit_waitq,
1155                                               !test_bit(IWL_MVM_STATUS_IN_D0I3,
1156                                                         &mvm->status),
1157                                               HZ),
1158                           "D0i3 exit on resume timed out\n");
1159 }
1160
1161 static void
1162 iwl_mvm_mac_reconfig_complete(struct ieee80211_hw *hw,
1163                               enum ieee80211_reconfig_type reconfig_type)
1164 {
1165         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1166
1167         switch (reconfig_type) {
1168         case IEEE80211_RECONFIG_TYPE_RESTART:
1169                 iwl_mvm_restart_complete(mvm);
1170                 break;
1171         case IEEE80211_RECONFIG_TYPE_SUSPEND:
1172                 iwl_mvm_resume_complete(mvm);
1173                 break;
1174         }
1175 }
1176
1177 void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
1178 {
1179         lockdep_assert_held(&mvm->mutex);
1180
1181         /* firmware counters are obviously reset now, but we shouldn't
1182          * partially track so also clear the fw_reset_accu counters.
1183          */
1184         memset(&mvm->accu_radio_stats, 0, sizeof(mvm->accu_radio_stats));
1185
1186         /* async_handlers_wk is now blocked */
1187
1188         /*
1189          * The work item could be running or queued if the
1190          * ROC time event stops just as we get here.
1191          */
1192         flush_work(&mvm->roc_done_wk);
1193
1194         iwl_mvm_stop_device(mvm);
1195
1196         iwl_mvm_async_handlers_purge(mvm);
1197         /* async_handlers_list is empty and will stay empty: HW is stopped */
1198
1199         /* the fw is stopped, the aux sta is dead: clean up driver state */
1200         iwl_mvm_del_aux_sta(mvm);
1201
1202         /*
1203          * Clear IN_HW_RESTART flag when stopping the hw (as restart_complete()
1204          * won't be called in this case).
1205          * But make sure to cleanup interfaces that have gone down before/during
1206          * HW restart was requested.
1207          */
1208         if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1209                 ieee80211_iterate_interfaces(mvm->hw, 0,
1210                                              iwl_mvm_cleanup_iterator, mvm);
1211
1212         /* We shouldn't have any UIDs still set.  Loop over all the UIDs to
1213          * make sure there's nothing left there and warn if any is found.
1214          */
1215         if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
1216                 int i;
1217
1218                 for (i = 0; i < mvm->max_scans; i++) {
1219                         if (WARN_ONCE(mvm->scan_uid_status[i],
1220                                       "UMAC scan UID %d status was not cleaned\n",
1221                                       i))
1222                                 mvm->scan_uid_status[i] = 0;
1223                 }
1224         }
1225 }
1226
1227 static void iwl_mvm_mac_stop(struct ieee80211_hw *hw)
1228 {
1229         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1230
1231         flush_work(&mvm->d0i3_exit_work);
1232         flush_work(&mvm->async_handlers_wk);
1233         flush_work(&mvm->add_stream_wk);
1234
1235         /*
1236          * Lock and clear the firmware running bit here already, so that
1237          * new commands coming in elsewhere, e.g. from debugfs, will not
1238          * be able to proceed. This is important here because one of those
1239          * debugfs files causes the firmware dump to be triggered, and if we
1240          * don't stop debugfs accesses before canceling that it could be
1241          * retriggered after we flush it but before we've cleared the bit.
1242          */
1243         clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
1244
1245         iwl_fw_cancel_dump(&mvm->fwrt);
1246         cancel_delayed_work_sync(&mvm->cs_tx_unblock_dwork);
1247         cancel_delayed_work_sync(&mvm->scan_timeout_dwork);
1248         iwl_fw_free_dump_desc(&mvm->fwrt);
1249
1250         mutex_lock(&mvm->mutex);
1251         __iwl_mvm_mac_stop(mvm);
1252         mutex_unlock(&mvm->mutex);
1253
1254         /*
1255          * The worker might have been waiting for the mutex, let it run and
1256          * discover that its list is now empty.
1257          */
1258         cancel_work_sync(&mvm->async_handlers_wk);
1259 }
1260
1261 static struct iwl_mvm_phy_ctxt *iwl_mvm_get_free_phy_ctxt(struct iwl_mvm *mvm)
1262 {
1263         u16 i;
1264
1265         lockdep_assert_held(&mvm->mutex);
1266
1267         for (i = 0; i < NUM_PHY_CTX; i++)
1268                 if (!mvm->phy_ctxts[i].ref)
1269                         return &mvm->phy_ctxts[i];
1270
1271         IWL_ERR(mvm, "No available PHY context\n");
1272         return NULL;
1273 }
1274
1275 static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1276                                 s16 tx_power)
1277 {
1278         struct iwl_dev_tx_power_cmd cmd = {
1279                 .v3.set_mode = cpu_to_le32(IWL_TX_POWER_MODE_SET_MAC),
1280                 .v3.mac_context_id =
1281                         cpu_to_le32(iwl_mvm_vif_from_mac80211(vif)->id),
1282                 .v3.pwr_restriction = cpu_to_le16(8 * tx_power),
1283         };
1284         int len = sizeof(cmd);
1285
1286         if (tx_power == IWL_DEFAULT_MAX_TX_POWER)
1287                 cmd.v3.pwr_restriction = cpu_to_le16(IWL_DEV_MAX_TX_POWER);
1288
1289         if (!fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_TX_POWER_ACK))
1290                 len = sizeof(cmd.v3);
1291
1292         return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
1293 }
1294
1295 static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
1296                                      struct ieee80211_vif *vif)
1297 {
1298         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1299         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1300         int ret;
1301
1302         mvmvif->mvm = mvm;
1303
1304         /*
1305          * make sure D0i3 exit is completed, otherwise a target access
1306          * during tx queue configuration could be done when still in
1307          * D0i3 state.
1308          */
1309         ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_ADD_IF);
1310         if (ret)
1311                 return ret;
1312
1313         /*
1314          * Not much to do here. The stack will not allow interface
1315          * types or combinations that we didn't advertise, so we
1316          * don't really have to check the types.
1317          */
1318
1319         mutex_lock(&mvm->mutex);
1320
1321         /* make sure that beacon statistics don't go backwards with FW reset */
1322         if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
1323                 mvmvif->beacon_stats.accu_num_beacons +=
1324                         mvmvif->beacon_stats.num_beacons;
1325
1326         /* Allocate resources for the MAC context, and add it to the fw  */
1327         ret = iwl_mvm_mac_ctxt_init(mvm, vif);
1328         if (ret)
1329                 goto out_unlock;
1330
1331         /* Counting number of interfaces is needed for legacy PM */
1332         if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1333                 mvm->vif_count++;
1334
1335         /*
1336          * The AP binding flow can be done only after the beacon
1337          * template is configured (which happens only in the mac80211
1338          * start_ap() flow), and adding the broadcast station can happen
1339          * only after the binding.
1340          * In addition, since modifying the MAC before adding a bcast
1341          * station is not allowed by the FW, delay the adding of MAC context to
1342          * the point where we can also add the bcast station.
1343          * In short: there's not much we can do at this point, other than
1344          * allocating resources :)
1345          */
1346         if (vif->type == NL80211_IFTYPE_AP ||
1347             vif->type == NL80211_IFTYPE_ADHOC) {
1348                 ret = iwl_mvm_alloc_bcast_sta(mvm, vif);
1349                 if (ret) {
1350                         IWL_ERR(mvm, "Failed to allocate bcast sta\n");
1351                         goto out_release;
1352                 }
1353
1354                 /*
1355                  * Only queue for this station is the mcast queue,
1356                  * which shouldn't be in TFD mask anyway
1357                  */
1358                 ret = iwl_mvm_allocate_int_sta(mvm, &mvmvif->mcast_sta,
1359                                                0, vif->type,
1360                                                IWL_STA_MULTICAST);
1361                 if (ret)
1362                         goto out_release;
1363
1364                 iwl_mvm_vif_dbgfs_register(mvm, vif);
1365                 goto out_unlock;
1366         }
1367
1368         mvmvif->features |= hw->netdev_features;
1369
1370         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
1371         if (ret)
1372                 goto out_release;
1373
1374         ret = iwl_mvm_power_update_mac(mvm);
1375         if (ret)
1376                 goto out_remove_mac;
1377
1378         /* beacon filtering */
1379         ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
1380         if (ret)
1381                 goto out_remove_mac;
1382
1383         if (!mvm->bf_allowed_vif &&
1384             vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
1385                 mvm->bf_allowed_vif = mvmvif;
1386                 vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
1387                                      IEEE80211_VIF_SUPPORTS_CQM_RSSI;
1388         }
1389
1390         /*
1391          * P2P_DEVICE interface does not have a channel context assigned to it,
1392          * so a dedicated PHY context is allocated to it and the corresponding
1393          * MAC context is bound to it at this stage.
1394          */
1395         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1396
1397                 mvmvif->phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
1398                 if (!mvmvif->phy_ctxt) {
1399                         ret = -ENOSPC;
1400                         goto out_free_bf;
1401                 }
1402
1403                 iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
1404                 ret = iwl_mvm_binding_add_vif(mvm, vif);
1405                 if (ret)
1406                         goto out_unref_phy;
1407
1408                 ret = iwl_mvm_add_p2p_bcast_sta(mvm, vif);
1409                 if (ret)
1410                         goto out_unbind;
1411
1412                 /* Save a pointer to p2p device vif, so it can later be used to
1413                  * update the p2p device MAC when a GO is started/stopped */
1414                 mvm->p2p_device_vif = vif;
1415         }
1416
1417         if (vif->type == NL80211_IFTYPE_MONITOR)
1418                 mvm->monitor_on = true;
1419
1420         iwl_mvm_vif_dbgfs_register(mvm, vif);
1421         goto out_unlock;
1422
1423  out_unbind:
1424         iwl_mvm_binding_remove_vif(mvm, vif);
1425  out_unref_phy:
1426         iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1427  out_free_bf:
1428         if (mvm->bf_allowed_vif == mvmvif) {
1429                 mvm->bf_allowed_vif = NULL;
1430                 vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1431                                        IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1432         }
1433  out_remove_mac:
1434         mvmvif->phy_ctxt = NULL;
1435         iwl_mvm_mac_ctxt_remove(mvm, vif);
1436  out_release:
1437         if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
1438                 mvm->vif_count--;
1439  out_unlock:
1440         mutex_unlock(&mvm->mutex);
1441
1442         iwl_mvm_unref(mvm, IWL_MVM_REF_ADD_IF);
1443
1444         return ret;
1445 }
1446
1447 static void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
1448                                         struct ieee80211_vif *vif)
1449 {
1450         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1451                 /*
1452                  * Flush the ROC worker which will flush the OFFCHANNEL queue.
1453                  * We assume here that all the packets sent to the OFFCHANNEL
1454                  * queue are sent in ROC session.
1455                  */
1456                 flush_work(&mvm->roc_done_wk);
1457         }
1458 }
1459
1460 static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
1461                                          struct ieee80211_vif *vif)
1462 {
1463         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1464         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1465
1466         iwl_mvm_prepare_mac_removal(mvm, vif);
1467
1468         mutex_lock(&mvm->mutex);
1469
1470         if (mvm->bf_allowed_vif == mvmvif) {
1471                 mvm->bf_allowed_vif = NULL;
1472                 vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
1473                                        IEEE80211_VIF_SUPPORTS_CQM_RSSI);
1474         }
1475
1476         iwl_mvm_vif_dbgfs_clean(mvm, vif);
1477
1478         /*
1479          * For AP/GO interface, the tear down of the resources allocated to the
1480          * interface is be handled as part of the stop_ap flow.
1481          */
1482         if (vif->type == NL80211_IFTYPE_AP ||
1483             vif->type == NL80211_IFTYPE_ADHOC) {
1484 #ifdef CONFIG_NL80211_TESTMODE
1485                 if (vif == mvm->noa_vif) {
1486                         mvm->noa_vif = NULL;
1487                         mvm->noa_duration = 0;
1488                 }
1489 #endif
1490                 iwl_mvm_dealloc_int_sta(mvm, &mvmvif->mcast_sta);
1491                 iwl_mvm_dealloc_bcast_sta(mvm, vif);
1492                 goto out_release;
1493         }
1494
1495         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
1496                 mvm->p2p_device_vif = NULL;
1497                 iwl_mvm_rm_p2p_bcast_sta(mvm, vif);
1498                 iwl_mvm_binding_remove_vif(mvm, vif);
1499                 iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
1500                 mvmvif->phy_ctxt = NULL;
1501         }
1502
1503         if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
1504                 mvm->vif_count--;
1505
1506         iwl_mvm_power_update_mac(mvm);
1507         iwl_mvm_mac_ctxt_remove(mvm, vif);
1508
1509         if (vif->type == NL80211_IFTYPE_MONITOR)
1510                 mvm->monitor_on = false;
1511
1512 out_release:
1513         mutex_unlock(&mvm->mutex);
1514 }
1515
1516 static int iwl_mvm_mac_config(struct ieee80211_hw *hw, u32 changed)
1517 {
1518         return 0;
1519 }
1520
1521 struct iwl_mvm_mc_iter_data {
1522         struct iwl_mvm *mvm;
1523         int port_id;
1524 };
1525
1526 static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
1527                                       struct ieee80211_vif *vif)
1528 {
1529         struct iwl_mvm_mc_iter_data *data = _data;
1530         struct iwl_mvm *mvm = data->mvm;
1531         struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
1532         struct iwl_host_cmd hcmd = {
1533                 .id = MCAST_FILTER_CMD,
1534                 .flags = CMD_ASYNC,
1535                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
1536         };
1537         int ret, len;
1538
1539         /* if we don't have free ports, mcast frames will be dropped */
1540         if (WARN_ON_ONCE(data->port_id >= MAX_PORT_ID_NUM))
1541                 return;
1542
1543         if (vif->type != NL80211_IFTYPE_STATION ||
1544             !vif->bss_conf.assoc)
1545                 return;
1546
1547         cmd->port_id = data->port_id++;
1548         memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
1549         len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
1550
1551         hcmd.len[0] = len;
1552         hcmd.data[0] = cmd;
1553
1554         ret = iwl_mvm_send_cmd(mvm, &hcmd);
1555         if (ret)
1556                 IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
1557 }
1558
1559 static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
1560 {
1561         struct iwl_mvm_mc_iter_data iter_data = {
1562                 .mvm = mvm,
1563         };
1564
1565         lockdep_assert_held(&mvm->mutex);
1566
1567         if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
1568                 return;
1569
1570         ieee80211_iterate_active_interfaces_atomic(
1571                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1572                 iwl_mvm_mc_iface_iterator, &iter_data);
1573 }
1574
1575 static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw,
1576                                      struct netdev_hw_addr_list *mc_list)
1577 {
1578         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1579         struct iwl_mcast_filter_cmd *cmd;
1580         struct netdev_hw_addr *addr;
1581         int addr_count;
1582         bool pass_all;
1583         int len;
1584
1585         addr_count = netdev_hw_addr_list_count(mc_list);
1586         pass_all = addr_count > MAX_MCAST_FILTERING_ADDRESSES ||
1587                    IWL_MVM_FW_MCAST_FILTER_PASS_ALL;
1588         if (pass_all)
1589                 addr_count = 0;
1590
1591         len = roundup(sizeof(*cmd) + addr_count * ETH_ALEN, 4);
1592         cmd = kzalloc(len, GFP_ATOMIC);
1593         if (!cmd)
1594                 return 0;
1595
1596         if (pass_all) {
1597                 cmd->pass_all = 1;
1598                 return (u64)(unsigned long)cmd;
1599         }
1600
1601         netdev_hw_addr_list_for_each(addr, mc_list) {
1602                 IWL_DEBUG_MAC80211(mvm, "mcast addr (%d): %pM\n",
1603                                    cmd->count, addr->addr);
1604                 memcpy(&cmd->addr_list[cmd->count * ETH_ALEN],
1605                        addr->addr, ETH_ALEN);
1606                 cmd->count++;
1607         }
1608
1609         return (u64)(unsigned long)cmd;
1610 }
1611
1612 static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
1613                                      unsigned int changed_flags,
1614                                      unsigned int *total_flags,
1615                                      u64 multicast)
1616 {
1617         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1618         struct iwl_mcast_filter_cmd *cmd = (void *)(unsigned long)multicast;
1619
1620         mutex_lock(&mvm->mutex);
1621
1622         /* replace previous configuration */
1623         kfree(mvm->mcast_filter_cmd);
1624         mvm->mcast_filter_cmd = cmd;
1625
1626         if (!cmd)
1627                 goto out;
1628
1629         if (changed_flags & FIF_ALLMULTI)
1630                 cmd->pass_all = !!(*total_flags & FIF_ALLMULTI);
1631
1632         if (cmd->pass_all)
1633                 cmd->count = 0;
1634
1635         iwl_mvm_recalc_multicast(mvm);
1636 out:
1637         mutex_unlock(&mvm->mutex);
1638         *total_flags = 0;
1639 }
1640
1641 static void iwl_mvm_config_iface_filter(struct ieee80211_hw *hw,
1642                                         struct ieee80211_vif *vif,
1643                                         unsigned int filter_flags,
1644                                         unsigned int changed_flags)
1645 {
1646         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
1647
1648         /* We support only filter for probe requests */
1649         if (!(changed_flags & FIF_PROBE_REQ))
1650                 return;
1651
1652         /* Supported only for p2p client interfaces */
1653         if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc ||
1654             !vif->p2p)
1655                 return;
1656
1657         mutex_lock(&mvm->mutex);
1658         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1659         mutex_unlock(&mvm->mutex);
1660 }
1661
1662 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
1663 struct iwl_bcast_iter_data {
1664         struct iwl_mvm *mvm;
1665         struct iwl_bcast_filter_cmd *cmd;
1666         u8 current_filter;
1667 };
1668
1669 static void
1670 iwl_mvm_set_bcast_filter(struct ieee80211_vif *vif,
1671                          const struct iwl_fw_bcast_filter *in_filter,
1672                          struct iwl_fw_bcast_filter *out_filter)
1673 {
1674         struct iwl_fw_bcast_filter_attr *attr;
1675         int i;
1676
1677         memcpy(out_filter, in_filter, sizeof(*out_filter));
1678
1679         for (i = 0; i < ARRAY_SIZE(out_filter->attrs); i++) {
1680                 attr = &out_filter->attrs[i];
1681
1682                 if (!attr->mask)
1683                         break;
1684
1685                 switch (attr->reserved1) {
1686                 case cpu_to_le16(BC_FILTER_MAGIC_IP):
1687                         if (vif->bss_conf.arp_addr_cnt != 1) {
1688                                 attr->mask = 0;
1689                                 continue;
1690                         }
1691
1692                         attr->val = vif->bss_conf.arp_addr_list[0];
1693                         break;
1694                 case cpu_to_le16(BC_FILTER_MAGIC_MAC):
1695                         attr->val = *(__be32 *)&vif->addr[2];
1696                         break;
1697                 default:
1698                         break;
1699                 }
1700                 attr->reserved1 = 0;
1701                 out_filter->num_attrs++;
1702         }
1703 }
1704
1705 static void iwl_mvm_bcast_filter_iterator(void *_data, u8 *mac,
1706                                           struct ieee80211_vif *vif)
1707 {
1708         struct iwl_bcast_iter_data *data = _data;
1709         struct iwl_mvm *mvm = data->mvm;
1710         struct iwl_bcast_filter_cmd *cmd = data->cmd;
1711         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1712         struct iwl_fw_bcast_mac *bcast_mac;
1713         int i;
1714
1715         if (WARN_ON(mvmvif->id >= ARRAY_SIZE(cmd->macs)))
1716                 return;
1717
1718         bcast_mac = &cmd->macs[mvmvif->id];
1719
1720         /*
1721          * enable filtering only for associated stations, but not for P2P
1722          * Clients
1723          */
1724         if (vif->type != NL80211_IFTYPE_STATION || vif->p2p ||
1725             !vif->bss_conf.assoc)
1726                 return;
1727
1728         bcast_mac->default_discard = 1;
1729
1730         /* copy all configured filters */
1731         for (i = 0; mvm->bcast_filters[i].attrs[0].mask; i++) {
1732                 /*
1733                  * Make sure we don't exceed our filters limit.
1734                  * if there is still a valid filter to be configured,
1735                  * be on the safe side and just allow bcast for this mac.
1736                  */
1737                 if (WARN_ON_ONCE(data->current_filter >=
1738                                  ARRAY_SIZE(cmd->filters))) {
1739                         bcast_mac->default_discard = 0;
1740                         bcast_mac->attached_filters = 0;
1741                         break;
1742                 }
1743
1744                 iwl_mvm_set_bcast_filter(vif,
1745                                          &mvm->bcast_filters[i],
1746                                          &cmd->filters[data->current_filter]);
1747
1748                 /* skip current filter if it contains no attributes */
1749                 if (!cmd->filters[data->current_filter].num_attrs)
1750                         continue;
1751
1752                 /* attach the filter to current mac */
1753                 bcast_mac->attached_filters |=
1754                                 cpu_to_le16(BIT(data->current_filter));
1755
1756                 data->current_filter++;
1757         }
1758 }
1759
1760 bool iwl_mvm_bcast_filter_build_cmd(struct iwl_mvm *mvm,
1761                                     struct iwl_bcast_filter_cmd *cmd)
1762 {
1763         struct iwl_bcast_iter_data iter_data = {
1764                 .mvm = mvm,
1765                 .cmd = cmd,
1766         };
1767
1768         if (IWL_MVM_FW_BCAST_FILTER_PASS_ALL)
1769                 return false;
1770
1771         memset(cmd, 0, sizeof(*cmd));
1772         cmd->max_bcast_filters = ARRAY_SIZE(cmd->filters);
1773         cmd->max_macs = ARRAY_SIZE(cmd->macs);
1774
1775 #ifdef CONFIG_IWLWIFI_DEBUGFS
1776         /* use debugfs filters/macs if override is configured */
1777         if (mvm->dbgfs_bcast_filtering.override) {
1778                 memcpy(cmd->filters, &mvm->dbgfs_bcast_filtering.cmd.filters,
1779                        sizeof(cmd->filters));
1780                 memcpy(cmd->macs, &mvm->dbgfs_bcast_filtering.cmd.macs,
1781                        sizeof(cmd->macs));
1782                 return true;
1783         }
1784 #endif
1785
1786         /* if no filters are configured, do nothing */
1787         if (!mvm->bcast_filters)
1788                 return false;
1789
1790         /* configure and attach these filters for each associated sta vif */
1791         ieee80211_iterate_active_interfaces(
1792                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1793                 iwl_mvm_bcast_filter_iterator, &iter_data);
1794
1795         return true;
1796 }
1797
1798 static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1799 {
1800         struct iwl_bcast_filter_cmd cmd;
1801
1802         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING))
1803                 return 0;
1804
1805         if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
1806                 return 0;
1807
1808         return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
1809                                     sizeof(cmd), &cmd);
1810 }
1811 #else
1812 static inline int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm)
1813 {
1814         return 0;
1815 }
1816 #endif
1817
1818 static int iwl_mvm_update_mu_groups(struct iwl_mvm *mvm,
1819                                     struct ieee80211_vif *vif)
1820 {
1821         struct iwl_mu_group_mgmt_cmd cmd = {};
1822
1823         memcpy(cmd.membership_status, vif->bss_conf.mu_group.membership,
1824                WLAN_MEMBERSHIP_LEN);
1825         memcpy(cmd.user_position, vif->bss_conf.mu_group.position,
1826                WLAN_USER_POSITION_LEN);
1827
1828         return iwl_mvm_send_cmd_pdu(mvm,
1829                                     WIDE_ID(DATA_PATH_GROUP,
1830                                             UPDATE_MU_GROUPS_CMD),
1831                                     0, sizeof(cmd), &cmd);
1832 }
1833
1834 static void iwl_mvm_mu_mimo_iface_iterator(void *_data, u8 *mac,
1835                                            struct ieee80211_vif *vif)
1836 {
1837         if (vif->mu_mimo_owner) {
1838                 struct iwl_mu_group_mgmt_notif *notif = _data;
1839
1840                 /*
1841                  * MU-MIMO Group Id action frame is little endian. We treat
1842                  * the data received from firmware as if it came from the
1843                  * action frame, so no conversion is needed.
1844                  */
1845                 ieee80211_update_mu_groups(vif,
1846                                            (u8 *)&notif->membership_status,
1847                                            (u8 *)&notif->user_position);
1848         }
1849 }
1850
1851 void iwl_mvm_mu_mimo_grp_notif(struct iwl_mvm *mvm,
1852                                struct iwl_rx_cmd_buffer *rxb)
1853 {
1854         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1855         struct iwl_mu_group_mgmt_notif *notif = (void *)pkt->data;
1856
1857         ieee80211_iterate_active_interfaces_atomic(
1858                         mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
1859                         iwl_mvm_mu_mimo_iface_iterator, notif);
1860 }
1861
1862 static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
1863                                              struct ieee80211_vif *vif,
1864                                              struct ieee80211_bss_conf *bss_conf,
1865                                              u32 changes)
1866 {
1867         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1868         int ret;
1869
1870         /*
1871          * Re-calculate the tsf id, as the master-slave relations depend on the
1872          * beacon interval, which was not known when the station interface was
1873          * added.
1874          */
1875         if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc)
1876                 iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
1877
1878         /*
1879          * If we're not associated yet, take the (new) BSSID before associating
1880          * so the firmware knows. If we're already associated, then use the old
1881          * BSSID here, and we'll send a cleared one later in the CHANGED_ASSOC
1882          * branch for disassociation below.
1883          */
1884         if (changes & BSS_CHANGED_BSSID && !mvmvif->associated)
1885                 memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
1886
1887         ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, mvmvif->bssid);
1888         if (ret)
1889                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
1890
1891         /* after sending it once, adopt mac80211 data */
1892         memcpy(mvmvif->bssid, bss_conf->bssid, ETH_ALEN);
1893         mvmvif->associated = bss_conf->assoc;
1894
1895         if (changes & BSS_CHANGED_ASSOC) {
1896                 if (bss_conf->assoc) {
1897                         /* clear statistics to get clean beacon counter */
1898                         iwl_mvm_request_statistics(mvm, true);
1899                         memset(&mvmvif->beacon_stats, 0,
1900                                sizeof(mvmvif->beacon_stats));
1901
1902                         /* add quota for this interface */
1903                         ret = iwl_mvm_update_quotas(mvm, true, NULL);
1904                         if (ret) {
1905                                 IWL_ERR(mvm, "failed to update quotas\n");
1906                                 return;
1907                         }
1908
1909                         if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
1910                                      &mvm->status)) {
1911                                 /*
1912                                  * If we're restarting then the firmware will
1913                                  * obviously have lost synchronisation with
1914                                  * the AP. It will attempt to synchronise by
1915                                  * itself, but we can make it more reliable by
1916                                  * scheduling a session protection time event.
1917                                  *
1918                                  * The firmware needs to receive a beacon to
1919                                  * catch up with synchronisation, use 110% of
1920                                  * the beacon interval.
1921                                  *
1922                                  * Set a large maximum delay to allow for more
1923                                  * than a single interface.
1924                                  */
1925                                 u32 dur = (11 * vif->bss_conf.beacon_int) / 10;
1926                                 iwl_mvm_protect_session(mvm, vif, dur, dur,
1927                                                         5 * dur, false);
1928                         }
1929
1930                         iwl_mvm_sf_update(mvm, vif, false);
1931                         iwl_mvm_power_vif_assoc(mvm, vif);
1932                         if (vif->p2p) {
1933                                 iwl_mvm_ref(mvm, IWL_MVM_REF_P2P_CLIENT);
1934                                 iwl_mvm_update_smps(mvm, vif,
1935                                                     IWL_MVM_SMPS_REQ_PROT,
1936                                                     IEEE80211_SMPS_DYNAMIC);
1937                         }
1938                 } else if (mvmvif->ap_sta_id != IWL_MVM_INVALID_STA) {
1939                         /*
1940                          * If update fails - SF might be running in associated
1941                          * mode while disassociated - which is forbidden.
1942                          */
1943                         WARN_ONCE(iwl_mvm_sf_update(mvm, vif, false),
1944                                   "Failed to update SF upon disassociation\n");
1945
1946                         /*
1947                          * If we get an assert during the connection (after the
1948                          * station has been added, but before the vif is set
1949                          * to associated), mac80211 will re-add the station and
1950                          * then configure the vif. Since the vif is not
1951                          * associated, we would remove the station here and
1952                          * this would fail the recovery.
1953                          */
1954                         if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
1955                                       &mvm->status)) {
1956                                 /*
1957                                  * Remove AP station now that
1958                                  * the MAC is unassoc
1959                                  */
1960                                 ret = iwl_mvm_rm_sta_id(mvm, vif,
1961                                                         mvmvif->ap_sta_id);
1962                                 if (ret)
1963                                         IWL_ERR(mvm,
1964                                                 "failed to remove AP station\n");
1965
1966                                 if (mvm->d0i3_ap_sta_id == mvmvif->ap_sta_id)
1967                                         mvm->d0i3_ap_sta_id =
1968                                                 IWL_MVM_INVALID_STA;
1969                                 mvmvif->ap_sta_id = IWL_MVM_INVALID_STA;
1970                         }
1971
1972                         /* remove quota for this interface */
1973                         ret = iwl_mvm_update_quotas(mvm, false, NULL);
1974                         if (ret)
1975                                 IWL_ERR(mvm, "failed to update quotas\n");
1976
1977                         if (vif->p2p)
1978                                 iwl_mvm_unref(mvm, IWL_MVM_REF_P2P_CLIENT);
1979
1980                         /* this will take the cleared BSSID from bss_conf */
1981                         ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
1982                         if (ret)
1983                                 IWL_ERR(mvm,
1984                                         "failed to update MAC %pM (clear after unassoc)\n",
1985                                         vif->addr);
1986                 }
1987
1988                 /*
1989                  * The firmware tracks the MU-MIMO group on its own.
1990                  * However, on HW restart we should restore this data.
1991                  */
1992                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
1993                     (changes & BSS_CHANGED_MU_GROUPS) && vif->mu_mimo_owner) {
1994                         ret = iwl_mvm_update_mu_groups(mvm, vif);
1995                         if (ret)
1996                                 IWL_ERR(mvm,
1997                                         "failed to update VHT MU_MIMO groups\n");
1998                 }
1999
2000                 iwl_mvm_recalc_multicast(mvm);
2001                 iwl_mvm_configure_bcast_filter(mvm);
2002
2003                 /* reset rssi values */
2004                 mvmvif->bf_data.ave_beacon_signal = 0;
2005
2006                 iwl_mvm_bt_coex_vif_change(mvm);
2007                 iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_TT,
2008                                     IEEE80211_SMPS_AUTOMATIC);
2009                 if (fw_has_capa(&mvm->fw->ucode_capa,
2010                                 IWL_UCODE_TLV_CAPA_UMAC_SCAN))
2011                         iwl_mvm_config_scan(mvm);
2012         }
2013
2014         if (changes & BSS_CHANGED_BEACON_INFO) {
2015                 /*
2016                  * We received a beacon from the associated AP so
2017                  * remove the session protection.
2018                  */
2019                 iwl_mvm_stop_session_protection(mvm, vif);
2020
2021                 iwl_mvm_sf_update(mvm, vif, false);
2022                 WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
2023         }
2024
2025         if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS | BSS_CHANGED_QOS |
2026                        /*
2027                         * Send power command on every beacon change,
2028                         * because we may have not enabled beacon abort yet.
2029                         */
2030                        BSS_CHANGED_BEACON_INFO)) {
2031                 ret = iwl_mvm_power_update_mac(mvm);
2032                 if (ret)
2033                         IWL_ERR(mvm, "failed to update power mode\n");
2034         }
2035
2036         if (changes & BSS_CHANGED_TXPOWER) {
2037                 IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2038                                 bss_conf->txpower);
2039                 iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2040         }
2041
2042         if (changes & BSS_CHANGED_CQM) {
2043                 IWL_DEBUG_MAC80211(mvm, "cqm info_changed\n");
2044                 /* reset cqm events tracking */
2045                 mvmvif->bf_data.last_cqm_event = 0;
2046                 if (mvmvif->bf_data.bf_enabled) {
2047                         ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
2048                         if (ret)
2049                                 IWL_ERR(mvm,
2050                                         "failed to update CQM thresholds\n");
2051                 }
2052         }
2053
2054         if (changes & BSS_CHANGED_ARP_FILTER) {
2055                 IWL_DEBUG_MAC80211(mvm, "arp filter changed\n");
2056                 iwl_mvm_configure_bcast_filter(mvm);
2057         }
2058 }
2059
2060 static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
2061                                  struct ieee80211_vif *vif)
2062 {
2063         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2064         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2065         int ret;
2066
2067         /*
2068          * iwl_mvm_mac_ctxt_add() might read directly from the device
2069          * (the system time), so make sure it is available.
2070          */
2071         ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_START_AP);
2072         if (ret)
2073                 return ret;
2074
2075         mutex_lock(&mvm->mutex);
2076
2077         /* Send the beacon template */
2078         ret = iwl_mvm_mac_ctxt_beacon_changed(mvm, vif);
2079         if (ret)
2080                 goto out_unlock;
2081
2082         /*
2083          * Re-calculate the tsf id, as the master-slave relations depend on the
2084          * beacon interval, which was not known when the AP interface was added.
2085          */
2086         if (vif->type == NL80211_IFTYPE_AP)
2087                 iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
2088
2089         mvmvif->ap_assoc_sta_count = 0;
2090
2091         /* Add the mac context */
2092         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
2093         if (ret)
2094                 goto out_unlock;
2095
2096         /* Perform the binding */
2097         ret = iwl_mvm_binding_add_vif(mvm, vif);
2098         if (ret)
2099                 goto out_remove;
2100
2101         ret = iwl_mvm_add_mcast_sta(mvm, vif);
2102         if (ret)
2103                 goto out_unbind;
2104
2105         /* Send the bcast station. At this stage the TBTT and DTIM time events
2106          * are added and applied to the scheduler */
2107         ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
2108         if (ret)
2109                 goto out_rm_mcast;
2110
2111         /* must be set before quota calculations */
2112         mvmvif->ap_ibss_active = true;
2113
2114         /* power updated needs to be done before quotas */
2115         iwl_mvm_power_update_mac(mvm);
2116
2117         ret = iwl_mvm_update_quotas(mvm, false, NULL);
2118         if (ret)
2119                 goto out_quota_failed;
2120
2121         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2122         if (vif->p2p && mvm->p2p_device_vif)
2123                 iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2124
2125         iwl_mvm_ref(mvm, IWL_MVM_REF_AP_IBSS);
2126
2127         iwl_mvm_bt_coex_vif_change(mvm);
2128
2129         /* we don't support TDLS during DCM */
2130         if (iwl_mvm_phy_ctx_count(mvm) > 1)
2131                 iwl_mvm_teardown_tdls_peers(mvm);
2132
2133         goto out_unlock;
2134
2135 out_quota_failed:
2136         iwl_mvm_power_update_mac(mvm);
2137         mvmvif->ap_ibss_active = false;
2138         iwl_mvm_send_rm_bcast_sta(mvm, vif);
2139 out_rm_mcast:
2140         iwl_mvm_rm_mcast_sta(mvm, vif);
2141 out_unbind:
2142         iwl_mvm_binding_remove_vif(mvm, vif);
2143 out_remove:
2144         iwl_mvm_mac_ctxt_remove(mvm, vif);
2145 out_unlock:
2146         mutex_unlock(&mvm->mutex);
2147         iwl_mvm_unref(mvm, IWL_MVM_REF_START_AP);
2148         return ret;
2149 }
2150
2151 static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
2152                                  struct ieee80211_vif *vif)
2153 {
2154         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2155         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2156
2157         iwl_mvm_prepare_mac_removal(mvm, vif);
2158
2159         mutex_lock(&mvm->mutex);
2160
2161         /* Handle AP stop while in CSA */
2162         if (rcu_access_pointer(mvm->csa_vif) == vif) {
2163                 iwl_mvm_remove_time_event(mvm, mvmvif,
2164                                           &mvmvif->time_event_data);
2165                 RCU_INIT_POINTER(mvm->csa_vif, NULL);
2166                 mvmvif->csa_countdown = false;
2167         }
2168
2169         if (rcu_access_pointer(mvm->csa_tx_blocked_vif) == vif) {
2170                 RCU_INIT_POINTER(mvm->csa_tx_blocked_vif, NULL);
2171                 mvm->csa_tx_block_bcn_timeout = 0;
2172         }
2173
2174         mvmvif->ap_ibss_active = false;
2175         mvm->ap_last_beacon_gp2 = 0;
2176
2177         iwl_mvm_bt_coex_vif_change(mvm);
2178
2179         iwl_mvm_unref(mvm, IWL_MVM_REF_AP_IBSS);
2180
2181         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
2182         if (vif->p2p && mvm->p2p_device_vif)
2183                 iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false, NULL);
2184
2185         iwl_mvm_update_quotas(mvm, false, NULL);
2186
2187         /*
2188          * This is not very nice, but the simplest:
2189          * For older FWs removing the mcast sta before the bcast station may
2190          * cause assert 0x2b00.
2191          * This is fixed in later FW (which will stop beaconing when removing
2192          * bcast station).
2193          * So make the order of removal depend on the TLV
2194          */
2195         if (!fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2196                 iwl_mvm_rm_mcast_sta(mvm, vif);
2197         iwl_mvm_send_rm_bcast_sta(mvm, vif);
2198         if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE))
2199                 iwl_mvm_rm_mcast_sta(mvm, vif);
2200         iwl_mvm_binding_remove_vif(mvm, vif);
2201
2202         iwl_mvm_power_update_mac(mvm);
2203
2204         iwl_mvm_mac_ctxt_remove(mvm, vif);
2205
2206         mutex_unlock(&mvm->mutex);
2207 }
2208
2209 static void
2210 iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
2211                                  struct ieee80211_vif *vif,
2212                                  struct ieee80211_bss_conf *bss_conf,
2213                                  u32 changes)
2214 {
2215         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2216
2217         /* Changes will be applied when the AP/IBSS is started */
2218         if (!mvmvif->ap_ibss_active)
2219                 return;
2220
2221         if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_HT |
2222                        BSS_CHANGED_BANDWIDTH | BSS_CHANGED_QOS) &&
2223             iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL))
2224                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
2225
2226         /* Need to send a new beacon template to the FW */
2227         if (changes & BSS_CHANGED_BEACON &&
2228             iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
2229                 IWL_WARN(mvm, "Failed updating beacon data\n");
2230
2231         if (changes & BSS_CHANGED_TXPOWER) {
2232                 IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
2233                                 bss_conf->txpower);
2234                 iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
2235         }
2236 }
2237
2238 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
2239                                      struct ieee80211_vif *vif,
2240                                      struct ieee80211_bss_conf *bss_conf,
2241                                      u32 changes)
2242 {
2243         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2244
2245         /*
2246          * iwl_mvm_bss_info_changed_station() might call
2247          * iwl_mvm_protect_session(), which reads directly from
2248          * the device (the system time), so make sure it is available.
2249          */
2250         if (iwl_mvm_ref_sync(mvm, IWL_MVM_REF_BSS_CHANGED))
2251                 return;
2252
2253         mutex_lock(&mvm->mutex);
2254
2255         if (changes & BSS_CHANGED_IDLE && !bss_conf->idle)
2256                 iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
2257
2258         switch (vif->type) {
2259         case NL80211_IFTYPE_STATION:
2260                 iwl_mvm_bss_info_changed_station(mvm, vif, bss_conf, changes);
2261                 break;
2262         case NL80211_IFTYPE_AP:
2263         case NL80211_IFTYPE_ADHOC:
2264                 iwl_mvm_bss_info_changed_ap_ibss(mvm, vif, bss_conf, changes);
2265                 break;
2266         case NL80211_IFTYPE_MONITOR:
2267                 if (changes & BSS_CHANGED_MU_GROUPS)
2268                         iwl_mvm_update_mu_groups(mvm, vif);
2269                 break;
2270         default:
2271                 /* shouldn't happen */
2272                 WARN_ON_ONCE(1);
2273         }
2274
2275         mutex_unlock(&mvm->mutex);
2276         iwl_mvm_unref(mvm, IWL_MVM_REF_BSS_CHANGED);
2277 }
2278
2279 static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
2280                                struct ieee80211_vif *vif,
2281                                struct ieee80211_scan_request *hw_req)
2282 {
2283         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2284         int ret;
2285
2286         if (hw_req->req.n_channels == 0 ||
2287             hw_req->req.n_channels > mvm->fw->ucode_capa.n_scan_channels)
2288                 return -EINVAL;
2289
2290         mutex_lock(&mvm->mutex);
2291         ret = iwl_mvm_reg_scan_start(mvm, vif, &hw_req->req, &hw_req->ies);
2292         mutex_unlock(&mvm->mutex);
2293
2294         return ret;
2295 }
2296
2297 static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
2298                                        struct ieee80211_vif *vif)
2299 {
2300         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2301
2302         mutex_lock(&mvm->mutex);
2303
2304         /* Due to a race condition, it's possible that mac80211 asks
2305          * us to stop a hw_scan when it's already stopped.  This can
2306          * happen, for instance, if we stopped the scan ourselves,
2307          * called ieee80211_scan_completed() and the userspace called
2308          * cancel scan scan before ieee80211_scan_work() could run.
2309          * To handle that, simply return if the scan is not running.
2310         */
2311         if (mvm->scan_status & IWL_MVM_SCAN_REGULAR)
2312                 iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
2313
2314         mutex_unlock(&mvm->mutex);
2315 }
2316
2317 static void
2318 iwl_mvm_mac_allow_buffered_frames(struct ieee80211_hw *hw,
2319                                   struct ieee80211_sta *sta, u16 tids,
2320                                   int num_frames,
2321                                   enum ieee80211_frame_release_type reason,
2322                                   bool more_data)
2323 {
2324         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2325
2326         /* Called when we need to transmit (a) frame(s) from mac80211 */
2327
2328         iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2329                                           tids, more_data, false);
2330 }
2331
2332 static void
2333 iwl_mvm_mac_release_buffered_frames(struct ieee80211_hw *hw,
2334                                     struct ieee80211_sta *sta, u16 tids,
2335                                     int num_frames,
2336                                     enum ieee80211_frame_release_type reason,
2337                                     bool more_data)
2338 {
2339         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2340
2341         /* Called when we need to transmit (a) frame(s) from agg or dqa queue */
2342
2343         iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
2344                                           tids, more_data, true);
2345 }
2346
2347 static void __iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2348                                      enum sta_notify_cmd cmd,
2349                                      struct ieee80211_sta *sta)
2350 {
2351         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2352         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
2353         unsigned long txqs = 0, tids = 0;
2354         int tid;
2355
2356         /*
2357          * If we have TVQM then we get too high queue numbers - luckily
2358          * we really shouldn't get here with that because such hardware
2359          * should have firmware supporting buffer station offload.
2360          */
2361         if (WARN_ON(iwl_mvm_has_new_tx_api(mvm)))
2362                 return;
2363
2364         spin_lock_bh(&mvmsta->lock);
2365         for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
2366                 struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
2367
2368                 if (tid_data->txq_id == IWL_MVM_INVALID_QUEUE)
2369                         continue;
2370
2371                 __set_bit(tid_data->txq_id, &txqs);
2372
2373                 if (iwl_mvm_tid_queued(mvm, tid_data) == 0)
2374                         continue;
2375
2376                 __set_bit(tid, &tids);
2377         }
2378
2379         switch (cmd) {
2380         case STA_NOTIFY_SLEEP:
2381                 for_each_set_bit(tid, &tids, IWL_MAX_TID_COUNT)
2382                         ieee80211_sta_set_buffered(sta, tid, true);
2383
2384                 if (txqs)
2385                         iwl_trans_freeze_txq_timer(mvm->trans, txqs, true);
2386                 /*
2387                  * The fw updates the STA to be asleep. Tx packets on the Tx
2388                  * queues to this station will not be transmitted. The fw will
2389                  * send a Tx response with TX_STATUS_FAIL_DEST_PS.
2390                  */
2391                 break;
2392         case STA_NOTIFY_AWAKE:
2393                 if (WARN_ON(mvmsta->sta_id == IWL_MVM_INVALID_STA))
2394                         break;
2395
2396                 if (txqs)
2397                         iwl_trans_freeze_txq_timer(mvm->trans, txqs, false);
2398                 iwl_mvm_sta_modify_ps_wake(mvm, sta);
2399                 break;
2400         default:
2401                 break;
2402         }
2403         spin_unlock_bh(&mvmsta->lock);
2404 }
2405
2406 static void iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
2407                                    struct ieee80211_vif *vif,
2408                                    enum sta_notify_cmd cmd,
2409                                    struct ieee80211_sta *sta)
2410 {
2411         __iwl_mvm_mac_sta_notify(hw, cmd, sta);
2412 }
2413
2414 void iwl_mvm_sta_pm_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
2415 {
2416         struct iwl_rx_packet *pkt = rxb_addr(rxb);
2417         struct iwl_mvm_pm_state_notification *notif = (void *)pkt->data;
2418         struct ieee80211_sta *sta;
2419         struct iwl_mvm_sta *mvmsta;
2420         bool sleeping = (notif->type != IWL_MVM_PM_EVENT_AWAKE);
2421
2422         if (WARN_ON(notif->sta_id >= ARRAY_SIZE(mvm->fw_id_to_mac_id)))
2423                 return;
2424
2425         rcu_read_lock();
2426         sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);
2427         if (WARN_ON(IS_ERR_OR_NULL(sta))) {
2428                 rcu_read_unlock();
2429                 return;
2430         }
2431
2432         mvmsta = iwl_mvm_sta_from_mac80211(sta);
2433
2434         if (!mvmsta->vif ||
2435             mvmsta->vif->type != NL80211_IFTYPE_AP) {
2436                 rcu_read_unlock();
2437                 return;
2438         }
2439
2440         if (mvmsta->sleeping != sleeping) {
2441                 mvmsta->sleeping = sleeping;
2442                 __iwl_mvm_mac_sta_notify(mvm->hw,
2443                         sleeping ? STA_NOTIFY_SLEEP : STA_NOTIFY_AWAKE,
2444                         sta);
2445                 ieee80211_sta_ps_transition(sta, sleeping);
2446         }
2447
2448         if (sleeping) {
2449                 switch (notif->type) {
2450                 case IWL_MVM_PM_EVENT_AWAKE:
2451                 case IWL_MVM_PM_EVENT_ASLEEP:
2452                         break;
2453                 case IWL_MVM_PM_EVENT_UAPSD:
2454                         ieee80211_sta_uapsd_trigger(sta, IEEE80211_NUM_TIDS);
2455                         break;
2456                 case IWL_MVM_PM_EVENT_PS_POLL:
2457                         ieee80211_sta_pspoll(sta);
2458                         break;
2459                 default:
2460                         break;
2461                 }
2462         }
2463
2464         rcu_read_unlock();
2465 }
2466
2467 static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
2468                                        struct ieee80211_vif *vif,
2469                                        struct ieee80211_sta *sta)
2470 {
2471         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2472         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
2473
2474         /*
2475          * This is called before mac80211 does RCU synchronisation,
2476          * so here we already invalidate our internal RCU-protected
2477          * station pointer. The rest of the code will thus no longer
2478          * be able to find the station this way, and we don't rely
2479          * on further RCU synchronisation after the sta_state()
2480          * callback deleted the station.
2481          */
2482         mutex_lock(&mvm->mutex);
2483         if (sta == rcu_access_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id]))
2484                 rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
2485                                    ERR_PTR(-ENOENT));
2486
2487         mutex_unlock(&mvm->mutex);
2488 }
2489
2490 static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
2491                                 const u8 *bssid)
2492 {
2493         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
2494                 return;
2495
2496         if (vif->p2p && !iwl_mvm_is_p2p_scm_uapsd_supported(mvm)) {
2497                 vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2498                 return;
2499         }
2500
2501         if (!vif->p2p &&
2502             (iwlwifi_mod_params.uapsd_disable & IWL_DISABLE_UAPSD_BSS)) {
2503                 vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
2504                 return;
2505         }
2506
2507         vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
2508 }
2509
2510 static void
2511 iwl_mvm_tdls_check_trigger(struct iwl_mvm *mvm,
2512                            struct ieee80211_vif *vif, u8 *peer_addr,
2513                            enum nl80211_tdls_operation action)
2514 {
2515         struct iwl_fw_dbg_trigger_tlv *trig;
2516         struct iwl_fw_dbg_trigger_tdls *tdls_trig;
2517
2518         if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_TDLS))
2519                 return;
2520
2521         trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_TDLS);
2522         tdls_trig = (void *)trig->data;
2523         if (!iwl_fw_dbg_trigger_check_stop(&mvm->fwrt,
2524                                            ieee80211_vif_to_wdev(vif), trig))
2525                 return;
2526
2527         if (!(tdls_trig->action_bitmap & BIT(action)))
2528                 return;
2529
2530         if (tdls_trig->peer_mode &&
2531             memcmp(tdls_trig->peer, peer_addr, ETH_ALEN) != 0)
2532                 return;
2533
2534         iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
2535                                 "TDLS event occurred, peer %pM, action %d",
2536                                 peer_addr, action);
2537 }
2538
2539 static void iwl_mvm_purge_deferred_tx_frames(struct iwl_mvm *mvm,
2540                                              struct iwl_mvm_sta *mvm_sta)
2541 {
2542         struct iwl_mvm_tid_data *tid_data;
2543         struct sk_buff *skb;
2544         int i;
2545
2546         spin_lock_bh(&mvm_sta->lock);
2547         for (i = 0; i <= IWL_MAX_TID_COUNT; i++) {
2548                 tid_data = &mvm_sta->tid_data[i];
2549
2550                 while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames))) {
2551                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2552
2553                         /*
2554                          * The first deferred frame should've stopped the MAC
2555                          * queues, so we should never get a second deferred
2556                          * frame for the RA/TID.
2557                          */
2558                         iwl_mvm_start_mac_queues(mvm, BIT(info->hw_queue));
2559                         ieee80211_free_txskb(mvm->hw, skb);
2560                 }
2561         }
2562         spin_unlock_bh(&mvm_sta->lock);
2563 }
2564
2565 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
2566                                  struct ieee80211_vif *vif,
2567                                  struct ieee80211_sta *sta,
2568                                  enum ieee80211_sta_state old_state,
2569                                  enum ieee80211_sta_state new_state)
2570 {
2571         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2572         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2573         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
2574         int ret;
2575
2576         IWL_DEBUG_MAC80211(mvm, "station %pM state change %d->%d\n",
2577                            sta->addr, old_state, new_state);
2578
2579         /* this would be a mac80211 bug ... but don't crash */
2580         if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
2581                 return -EINVAL;
2582
2583         /*
2584          * If we are in a STA removal flow and in DQA mode:
2585          *
2586          * This is after the sync_rcu part, so the queues have already been
2587          * flushed. No more TXs on their way in mac80211's path, and no more in
2588          * the queues.
2589          * Also, we won't be getting any new TX frames for this station.
2590          * What we might have are deferred TX frames that need to be taken care
2591          * of.
2592          *
2593          * Drop any still-queued deferred-frame before removing the STA, and
2594          * make sure the worker is no longer handling frames for this STA.
2595          */
2596         if (old_state == IEEE80211_STA_NONE &&
2597             new_state == IEEE80211_STA_NOTEXIST) {
2598                 iwl_mvm_purge_deferred_tx_frames(mvm, mvm_sta);
2599                 flush_work(&mvm->add_stream_wk);
2600
2601                 /*
2602                  * No need to make sure deferred TX indication is off since the
2603                  * worker will already remove it if it was on
2604                  */
2605         }
2606
2607         mutex_lock(&mvm->mutex);
2608         /* track whether or not the station is associated */
2609         mvm_sta->associated = new_state >= IEEE80211_STA_ASSOC;
2610
2611         if (old_state == IEEE80211_STA_NOTEXIST &&
2612             new_state == IEEE80211_STA_NONE) {
2613                 /*
2614                  * Firmware bug - it'll crash if the beacon interval is less
2615                  * than 16. We can't avoid connecting at all, so refuse the
2616                  * station state change, this will cause mac80211 to abandon
2617                  * attempts to connect to this AP, and eventually wpa_s will
2618                  * blacklist the AP...
2619                  */
2620                 if (vif->type == NL80211_IFTYPE_STATION &&
2621                     vif->bss_conf.beacon_int < 16) {
2622                         IWL_ERR(mvm,
2623                                 "AP %pM beacon interval is %d, refusing due to firmware bug!\n",
2624                                 sta->addr, vif->bss_conf.beacon_int);
2625                         ret = -EINVAL;
2626                         goto out_unlock;
2627                 }
2628
2629                 if (sta->tdls &&
2630                     (vif->p2p ||
2631                      iwl_mvm_tdls_sta_count(mvm, NULL) ==
2632                                                 IWL_MVM_TDLS_STA_COUNT ||
2633                      iwl_mvm_phy_ctx_count(mvm) > 1)) {
2634                         IWL_DEBUG_MAC80211(mvm, "refusing TDLS sta\n");
2635                         ret = -EBUSY;
2636                         goto out_unlock;
2637                 }
2638
2639                 ret = iwl_mvm_add_sta(mvm, vif, sta);
2640                 if (sta->tdls && ret == 0) {
2641                         iwl_mvm_recalc_tdls_state(mvm, vif, true);
2642                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
2643                                                    NL80211_TDLS_SETUP);
2644                 }
2645         } else if (old_state == IEEE80211_STA_NONE &&
2646                    new_state == IEEE80211_STA_AUTH) {
2647                 /*
2648                  * EBS may be disabled due to previous failures reported by FW.
2649                  * Reset EBS status here assuming environment has been changed.
2650                  */
2651                 mvm->last_ebs_successful = true;
2652                 iwl_mvm_check_uapsd(mvm, vif, sta->addr);
2653                 ret = 0;
2654         } else if (old_state == IEEE80211_STA_AUTH &&
2655                    new_state == IEEE80211_STA_ASSOC) {
2656                 if (vif->type == NL80211_IFTYPE_AP) {
2657                         mvmvif->ap_assoc_sta_count++;
2658                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2659                 }
2660
2661                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
2662                                      true);
2663                 ret = iwl_mvm_update_sta(mvm, vif, sta);
2664         } else if (old_state == IEEE80211_STA_ASSOC &&
2665                    new_state == IEEE80211_STA_AUTHORIZED) {
2666
2667                 /* we don't support TDLS during DCM */
2668                 if (iwl_mvm_phy_ctx_count(mvm) > 1)
2669                         iwl_mvm_teardown_tdls_peers(mvm);
2670
2671                 if (sta->tdls)
2672                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
2673                                                    NL80211_TDLS_ENABLE_LINK);
2674
2675                 /* enable beacon filtering */
2676                 WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
2677                 ret = 0;
2678         } else if (old_state == IEEE80211_STA_AUTHORIZED &&
2679                    new_state == IEEE80211_STA_ASSOC) {
2680                 /* disable beacon filtering */
2681                 WARN_ON(iwl_mvm_disable_beacon_filter(mvm, vif, 0));
2682                 ret = 0;
2683         } else if (old_state == IEEE80211_STA_ASSOC &&
2684                    new_state == IEEE80211_STA_AUTH) {
2685                 if (vif->type == NL80211_IFTYPE_AP) {
2686                         mvmvif->ap_assoc_sta_count--;
2687                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2688                 }
2689                 ret = 0;
2690         } else if (old_state == IEEE80211_STA_AUTH &&
2691                    new_state == IEEE80211_STA_NONE) {
2692                 ret = 0;
2693         } else if (old_state == IEEE80211_STA_NONE &&
2694                    new_state == IEEE80211_STA_NOTEXIST) {
2695                 ret = iwl_mvm_rm_sta(mvm, vif, sta);
2696                 if (sta->tdls) {
2697                         iwl_mvm_recalc_tdls_state(mvm, vif, false);
2698                         iwl_mvm_tdls_check_trigger(mvm, vif, sta->addr,
2699                                                    NL80211_TDLS_DISABLE_LINK);
2700                 }
2701         } else {
2702                 ret = -EIO;
2703         }
2704  out_unlock:
2705         mutex_unlock(&mvm->mutex);
2706
2707         if (sta->tdls && ret == 0) {
2708                 if (old_state == IEEE80211_STA_NOTEXIST &&
2709                     new_state == IEEE80211_STA_NONE)
2710                         ieee80211_reserve_tid(sta, IWL_MVM_TDLS_FW_TID);
2711                 else if (old_state == IEEE80211_STA_NONE &&
2712                          new_state == IEEE80211_STA_NOTEXIST)
2713                         ieee80211_unreserve_tid(sta, IWL_MVM_TDLS_FW_TID);
2714         }
2715
2716         return ret;
2717 }
2718
2719 static int iwl_mvm_mac_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
2720 {
2721         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2722
2723         mvm->rts_threshold = value;
2724
2725         return 0;
2726 }
2727
2728 static void iwl_mvm_sta_rc_update(struct ieee80211_hw *hw,
2729                                   struct ieee80211_vif *vif,
2730                                   struct ieee80211_sta *sta, u32 changed)
2731 {
2732         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2733
2734         if (vif->type == NL80211_IFTYPE_STATION &&
2735             changed & IEEE80211_RC_NSS_CHANGED)
2736                 iwl_mvm_sf_update(mvm, vif, false);
2737 }
2738
2739 static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
2740                                struct ieee80211_vif *vif, u16 ac,
2741                                const struct ieee80211_tx_queue_params *params)
2742 {
2743         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2744         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
2745
2746         mvmvif->queue_params[ac] = *params;
2747
2748         /*
2749          * No need to update right away, we'll get BSS_CHANGED_QOS
2750          * The exception is P2P_DEVICE interface which needs immediate update.
2751          */
2752         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
2753                 int ret;
2754
2755                 mutex_lock(&mvm->mutex);
2756                 ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
2757                 mutex_unlock(&mvm->mutex);
2758                 return ret;
2759         }
2760         return 0;
2761 }
2762
2763 static void iwl_mvm_mac_mgd_prepare_tx(struct ieee80211_hw *hw,
2764                                       struct ieee80211_vif *vif)
2765 {
2766         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2767         u32 duration = IWL_MVM_TE_SESSION_PROTECTION_MAX_TIME_MS;
2768         u32 min_duration = IWL_MVM_TE_SESSION_PROTECTION_MIN_TIME_MS;
2769
2770         if (WARN_ON_ONCE(vif->bss_conf.assoc))
2771                 return;
2772
2773         /*
2774          * iwl_mvm_protect_session() reads directly from the device
2775          * (the system time), so make sure it is available.
2776          */
2777         if (iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PREPARE_TX))
2778                 return;
2779
2780         mutex_lock(&mvm->mutex);
2781         /* Try really hard to protect the session and hear a beacon */
2782         iwl_mvm_protect_session(mvm, vif, duration, min_duration, 500, false);
2783         mutex_unlock(&mvm->mutex);
2784
2785         iwl_mvm_unref(mvm, IWL_MVM_REF_PREPARE_TX);
2786 }
2787
2788 static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
2789                                         struct ieee80211_vif *vif,
2790                                         struct cfg80211_sched_scan_request *req,
2791                                         struct ieee80211_scan_ies *ies)
2792 {
2793         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2794
2795         int ret;
2796
2797         mutex_lock(&mvm->mutex);
2798
2799         if (!vif->bss_conf.idle) {
2800                 ret = -EBUSY;
2801                 goto out;
2802         }
2803
2804         ret = iwl_mvm_sched_scan_start(mvm, vif, req, ies, IWL_MVM_SCAN_SCHED);
2805
2806 out:
2807         mutex_unlock(&mvm->mutex);
2808         return ret;
2809 }
2810
2811 static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
2812                                        struct ieee80211_vif *vif)
2813 {
2814         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2815         int ret;
2816
2817         mutex_lock(&mvm->mutex);
2818
2819         /* Due to a race condition, it's possible that mac80211 asks
2820          * us to stop a sched_scan when it's already stopped.  This
2821          * can happen, for instance, if we stopped the scan ourselves,
2822          * called ieee80211_sched_scan_stopped() and the userspace called
2823          * stop sched scan scan before ieee80211_sched_scan_stopped_work()
2824          * could run.  To handle this, simply return if the scan is
2825          * not running.
2826         */
2827         if (!(mvm->scan_status & IWL_MVM_SCAN_SCHED)) {
2828                 mutex_unlock(&mvm->mutex);
2829                 return 0;
2830         }
2831
2832         ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, false);
2833         mutex_unlock(&mvm->mutex);
2834         iwl_mvm_wait_for_async_handlers(mvm);
2835
2836         return ret;
2837 }
2838
2839 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
2840                                enum set_key_cmd cmd,
2841                                struct ieee80211_vif *vif,
2842                                struct ieee80211_sta *sta,
2843                                struct ieee80211_key_conf *key)
2844 {
2845         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
2846         struct iwl_mvm_sta *mvmsta;
2847         struct iwl_mvm_key_pn *ptk_pn;
2848         int keyidx = key->keyidx;
2849         int ret;
2850         u8 key_offset;
2851
2852         if (iwlwifi_mod_params.swcrypto) {
2853                 IWL_DEBUG_MAC80211(mvm, "leave - hwcrypto disabled\n");
2854                 return -EOPNOTSUPP;
2855         }
2856
2857         switch (key->cipher) {
2858         case WLAN_CIPHER_SUITE_TKIP:
2859                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
2860                 key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
2861                 break;
2862         case WLAN_CIPHER_SUITE_CCMP:
2863         case WLAN_CIPHER_SUITE_GCMP:
2864         case WLAN_CIPHER_SUITE_GCMP_256:
2865                 if (!iwl_mvm_has_new_tx_api(mvm))
2866                         key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
2867                 break;
2868         case WLAN_CIPHER_SUITE_AES_CMAC:
2869         case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2870         case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2871                 WARN_ON_ONCE(!ieee80211_hw_check(hw, MFP_CAPABLE));
2872                 break;
2873         case WLAN_CIPHER_SUITE_WEP40:
2874         case WLAN_CIPHER_SUITE_WEP104:
2875                 /* For non-client mode, only use WEP keys for TX as we probably
2876                  * don't have a station yet anyway and would then have to keep
2877                  * track of the keys, linking them to each of the clients/peers
2878                  * as they appear. For now, don't do that, for performance WEP
2879                  * offload doesn't really matter much, but we need it for some
2880                  * other offload features in client mode.
2881                  */
2882                 if (vif->type != NL80211_IFTYPE_STATION)
2883                         return 0;
2884                 break;
2885         default:
2886                 /* currently FW supports only one optional cipher scheme */
2887                 if (hw->n_cipher_schemes &&
2888                     hw->cipher_schemes->cipher == key->cipher)
2889                         key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
2890                 else
2891                         return -EOPNOTSUPP;
2892         }
2893
2894         mutex_lock(&mvm->mutex);
2895
2896         switch (cmd) {
2897         case SET_KEY:
2898                 if ((vif->type == NL80211_IFTYPE_ADHOC ||
2899                      vif->type == NL80211_IFTYPE_AP) && !sta) {
2900                         /*
2901                          * GTK on AP interface is a TX-only key, return 0;
2902                          * on IBSS they're per-station and because we're lazy
2903                          * we don't support them for RX, so do the same.
2904                          * CMAC/GMAC in AP/IBSS modes must be done in software.
2905                          */
2906                         if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
2907                             key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
2908                             key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
2909                                 ret = -EOPNOTSUPP;
2910                         else
2911                                 ret = 0;
2912
2913                         if (key->cipher != WLAN_CIPHER_SUITE_GCMP &&
2914                             key->cipher != WLAN_CIPHER_SUITE_GCMP_256 &&
2915                             !iwl_mvm_has_new_tx_api(mvm)) {
2916                                 key->hw_key_idx = STA_KEY_IDX_INVALID;
2917                                 break;
2918                         }
2919                 }
2920
2921                 /* During FW restart, in order to restore the state as it was,
2922                  * don't try to reprogram keys we previously failed for.
2923                  */
2924                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2925                     key->hw_key_idx == STA_KEY_IDX_INVALID) {
2926                         IWL_DEBUG_MAC80211(mvm,
2927                                            "skip invalid idx key programming during restart\n");
2928                         ret = 0;
2929                         break;
2930                 }
2931
2932                 if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
2933                     sta && iwl_mvm_has_new_rx_api(mvm) &&
2934                     key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
2935                     (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
2936                      key->cipher == WLAN_CIPHER_SUITE_GCMP ||
2937                      key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
2938                         struct ieee80211_key_seq seq;
2939                         int tid, q;
2940
2941                         mvmsta = iwl_mvm_sta_from_mac80211(sta);
2942                         WARN_ON(rcu_access_pointer(mvmsta->ptk_pn[keyidx]));
2943                         ptk_pn = kzalloc(sizeof(*ptk_pn) +
2944                                          mvm->trans->num_rx_queues *
2945                                                 sizeof(ptk_pn->q[0]),
2946                                          GFP_KERNEL);
2947                         if (!ptk_pn) {
2948                                 ret = -ENOMEM;
2949                                 break;
2950                         }
2951
2952                         for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
2953                                 ieee80211_get_key_rx_seq(key, tid, &seq);
2954                                 for (q = 0; q < mvm->trans->num_rx_queues; q++)
2955                                         memcpy(ptk_pn->q[q].pn[tid],
2956                                                seq.ccmp.pn,
2957                                                IEEE80211_CCMP_PN_LEN);
2958                         }
2959
2960                         rcu_assign_pointer(mvmsta->ptk_pn[keyidx], ptk_pn);
2961                 }
2962
2963                 /* in HW restart reuse the index, otherwise request a new one */
2964                 if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
2965                         key_offset = key->hw_key_idx;
2966                 else
2967                         key_offset = STA_KEY_IDX_INVALID;
2968
2969                 IWL_DEBUG_MAC80211(mvm, "set hwcrypto key\n");
2970                 ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, key_offset);
2971                 if (ret) {
2972                         IWL_WARN(mvm, "set key failed\n");
2973                         /*
2974                          * can't add key for RX, but we don't need it
2975                          * in the device for TX so still return 0
2976                          */
2977                         key->hw_key_idx = STA_KEY_IDX_INVALID;
2978                         ret = 0;
2979                 }
2980
2981                 break;
2982         case DISABLE_KEY:
2983                 if (key->hw_key_idx == STA_KEY_IDX_INVALID) {
2984                         ret = 0;
2985                         break;
2986                 }
2987
2988                 if (sta && iwl_mvm_has_new_rx_api(mvm) &&
2989                     key->flags & IEEE80211_KEY_FLAG_PAIRWISE &&
2990                     (key->cipher == WLAN_CIPHER_SUITE_CCMP ||
2991                      key->cipher == WLAN_CIPHER_SUITE_GCMP ||
2992                      key->cipher == WLAN_CIPHER_SUITE_GCMP_256)) {
2993                         mvmsta = iwl_mvm_sta_from_mac80211(sta);
2994                         ptk_pn = rcu_dereference_protected(
2995                                                 mvmsta->ptk_pn[keyidx],
2996                                                 lockdep_is_held(&mvm->mutex));
2997                         RCU_INIT_POINTER(mvmsta->ptk_pn[keyidx], NULL);
2998                         if (ptk_pn)
2999                                 kfree_rcu(ptk_pn, rcu_head);
3000                 }
3001
3002                 IWL_DEBUG_MAC80211(mvm, "disable hwcrypto key\n");
3003                 ret = iwl_mvm_remove_sta_key(mvm, vif, sta, key);
3004                 break;
3005         default:
3006                 ret = -EINVAL;
3007         }
3008
3009         mutex_unlock(&mvm->mutex);
3010         return ret;
3011 }
3012
3013 static void iwl_mvm_mac_update_tkip_key(struct ieee80211_hw *hw,
3014                                         struct ieee80211_vif *vif,
3015                                         struct ieee80211_key_conf *keyconf,
3016                                         struct ieee80211_sta *sta,
3017                                         u32 iv32, u16 *phase1key)
3018 {
3019         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3020
3021         if (keyconf->hw_key_idx == STA_KEY_IDX_INVALID)
3022                 return;
3023
3024         iwl_mvm_update_tkip_key(mvm, vif, keyconf, sta, iv32, phase1key);
3025 }
3026
3027
3028 static bool iwl_mvm_rx_aux_roc(struct iwl_notif_wait_data *notif_wait,
3029                                struct iwl_rx_packet *pkt, void *data)
3030 {
3031         struct iwl_mvm *mvm =
3032                 container_of(notif_wait, struct iwl_mvm, notif_wait);
3033         struct iwl_hs20_roc_res *resp;
3034         int resp_len = iwl_rx_packet_payload_len(pkt);
3035         struct iwl_mvm_time_event_data *te_data = data;
3036
3037         if (WARN_ON(pkt->hdr.cmd != HOT_SPOT_CMD))
3038                 return true;
3039
3040         if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
3041                 IWL_ERR(mvm, "Invalid HOT_SPOT_CMD response\n");
3042                 return true;
3043         }
3044
3045         resp = (void *)pkt->data;
3046
3047         IWL_DEBUG_TE(mvm,
3048                      "Aux ROC: Recieved response from ucode: status=%d uid=%d\n",
3049                      resp->status, resp->event_unique_id);
3050
3051         te_data->uid = le32_to_cpu(resp->event_unique_id);
3052         IWL_DEBUG_TE(mvm, "TIME_EVENT_CMD response - UID = 0x%x\n",
3053                      te_data->uid);
3054
3055         spin_lock_bh(&mvm->time_event_lock);
3056         list_add_tail(&te_data->list, &mvm->aux_roc_te_list);
3057         spin_unlock_bh(&mvm->time_event_lock);
3058
3059         return true;
3060 }
3061
3062 #define AUX_ROC_MIN_DURATION MSEC_TO_TU(100)
3063 #define AUX_ROC_MIN_DELAY MSEC_TO_TU(200)
3064 #define AUX_ROC_MAX_DELAY MSEC_TO_TU(600)
3065 #define AUX_ROC_SAFETY_BUFFER MSEC_TO_TU(20)
3066 #define AUX_ROC_MIN_SAFETY_BUFFER MSEC_TO_TU(10)
3067 static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
3068                                     struct ieee80211_channel *channel,
3069                                     struct ieee80211_vif *vif,
3070                                     int duration)
3071 {
3072         int res, time_reg = DEVICE_SYSTEM_TIME_REG;
3073         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3074         struct iwl_mvm_time_event_data *te_data = &mvmvif->hs_time_event_data;
3075         static const u16 time_event_response[] = { HOT_SPOT_CMD };
3076         struct iwl_notification_wait wait_time_event;
3077         u32 dtim_interval = vif->bss_conf.dtim_period *
3078                 vif->bss_conf.beacon_int;
3079         u32 req_dur, delay;
3080         struct iwl_hs20_roc_req aux_roc_req = {
3081                 .action = cpu_to_le32(FW_CTXT_ACTION_ADD),
3082                 .id_and_color =
3083                         cpu_to_le32(FW_CMD_ID_AND_COLOR(MAC_INDEX_AUX, 0)),
3084                 .sta_id_and_color = cpu_to_le32(mvm->aux_sta.sta_id),
3085                 /* Set the channel info data */
3086                 .channel_info.band = (channel->band == NL80211_BAND_2GHZ) ?
3087                         PHY_BAND_24 : PHY_BAND_5,
3088                 .channel_info.channel = channel->hw_value,
3089                 .channel_info.width = PHY_VHT_CHANNEL_MODE20,
3090                 /* Set the time and duration */
3091                 .apply_time = cpu_to_le32(iwl_read_prph(mvm->trans, time_reg)),
3092          };
3093
3094         delay = AUX_ROC_MIN_DELAY;
3095         req_dur = MSEC_TO_TU(duration);
3096
3097         /*
3098          * If we are associated we want the delay time to be at least one
3099          * dtim interval so that the FW can wait until after the DTIM and
3100          * then start the time event, this will potentially allow us to
3101          * remain off-channel for the max duration.
3102          * Since we want to use almost a whole dtim interval we would also
3103          * like the delay to be for 2-3 dtim intervals, in case there are
3104          * other time events with higher priority.
3105          */
3106         if (vif->bss_conf.assoc) {
3107                 delay = min_t(u32, dtim_interval * 3, AUX_ROC_MAX_DELAY);
3108                 /* We cannot remain off-channel longer than the DTIM interval */
3109                 if (dtim_interval <= req_dur) {
3110                         req_dur = dtim_interval - AUX_ROC_SAFETY_BUFFER;
3111                         if (req_dur <= AUX_ROC_MIN_DURATION)
3112                                 req_dur = dtim_interval -
3113                                         AUX_ROC_MIN_SAFETY_BUFFER;
3114                 }
3115         }
3116
3117         aux_roc_req.duration = cpu_to_le32(req_dur);
3118         aux_roc_req.apply_time_max_delay = cpu_to_le32(delay);
3119
3120         IWL_DEBUG_TE(mvm,
3121                      "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
3122                      channel->hw_value, req_dur, duration, delay,
3123                      dtim_interval);
3124         /* Set the node address */
3125         memcpy(aux_roc_req.node_addr, vif->addr, ETH_ALEN);
3126
3127         lockdep_assert_held(&mvm->mutex);
3128
3129         spin_lock_bh(&mvm->time_event_lock);
3130
3131         if (WARN_ON(te_data->id == HOT_SPOT_CMD)) {
3132                 spin_unlock_bh(&mvm->time_event_lock);
3133                 return -EIO;
3134         }
3135
3136         te_data->vif = vif;
3137         te_data->duration = duration;
3138         te_data->id = HOT_SPOT_CMD;
3139
3140         spin_unlock_bh(&mvm->time_event_lock);
3141
3142         /*
3143          * Use a notification wait, which really just processes the
3144          * command response and doesn't wait for anything, in order
3145          * to be able to process the response and get the UID inside
3146          * the RX path. Using CMD_WANT_SKB doesn't work because it
3147          * stores the buffer and then wakes up this thread, by which
3148          * time another notification (that the time event started)
3149          * might already be processed unsuccessfully.
3150          */
3151         iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
3152                                    time_event_response,
3153                                    ARRAY_SIZE(time_event_response),
3154                                    iwl_mvm_rx_aux_roc, te_data);
3155
3156         res = iwl_mvm_send_cmd_pdu(mvm, HOT_SPOT_CMD, 0, sizeof(aux_roc_req),
3157                                    &aux_roc_req);
3158
3159         if (res) {
3160                 IWL_ERR(mvm, "Couldn't send HOT_SPOT_CMD: %d\n", res);
3161                 iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
3162                 goto out_clear_te;
3163         }
3164
3165         /* No need to wait for anything, so just pass 1 (0 isn't valid) */
3166         res = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1);
3167         /* should never fail */
3168         WARN_ON_ONCE(res);
3169
3170         if (res) {
3171  out_clear_te:
3172                 spin_lock_bh(&mvm->time_event_lock);
3173                 iwl_mvm_te_clear_data(mvm, te_data);
3174                 spin_unlock_bh(&mvm->time_event_lock);
3175         }
3176
3177         return res;
3178 }
3179
3180 static int iwl_mvm_roc(struct ieee80211_hw *hw,
3181                        struct ieee80211_vif *vif,
3182                        struct ieee80211_channel *channel,
3183                        int duration,
3184                        enum ieee80211_roc_type type)
3185 {
3186         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3187         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3188         struct cfg80211_chan_def chandef;
3189         struct iwl_mvm_phy_ctxt *phy_ctxt;
3190         int ret, i;
3191
3192         IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
3193                            duration, type);
3194
3195         /*
3196          * Flush the done work, just in case it's still pending, so that
3197          * the work it does can complete and we can accept new frames.
3198          */
3199         flush_work(&mvm->roc_done_wk);
3200
3201         mutex_lock(&mvm->mutex);
3202
3203         switch (vif->type) {
3204         case NL80211_IFTYPE_STATION:
3205                 if (fw_has_capa(&mvm->fw->ucode_capa,
3206                                 IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT)) {
3207                         /* Use aux roc framework (HS20) */
3208                         ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
3209                                                        vif, duration);
3210                         goto out_unlock;
3211                 }
3212                 IWL_ERR(mvm, "hotspot not supported\n");
3213                 ret = -EINVAL;
3214                 goto out_unlock;
3215         case NL80211_IFTYPE_P2P_DEVICE:
3216                 /* handle below */
3217                 break;
3218         default:
3219                 IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type);
3220                 ret = -EINVAL;
3221                 goto out_unlock;
3222         }
3223
3224         for (i = 0; i < NUM_PHY_CTX; i++) {
3225                 phy_ctxt = &mvm->phy_ctxts[i];
3226                 if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
3227                         continue;
3228
3229                 if (phy_ctxt->ref && channel == phy_ctxt->channel) {
3230                         /*
3231                          * Unbind the P2P_DEVICE from the current PHY context,
3232                          * and if the PHY context is not used remove it.
3233                          */
3234                         ret = iwl_mvm_binding_remove_vif(mvm, vif);
3235                         if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3236                                 goto out_unlock;
3237
3238                         iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3239
3240                         /* Bind the P2P_DEVICE to the current PHY Context */
3241                         mvmvif->phy_ctxt = phy_ctxt;
3242
3243                         ret = iwl_mvm_binding_add_vif(mvm, vif);
3244                         if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3245                                 goto out_unlock;
3246
3247                         iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3248                         goto schedule_time_event;
3249                 }
3250         }
3251
3252         /* Need to update the PHY context only if the ROC channel changed */
3253         if (channel == mvmvif->phy_ctxt->channel)
3254                 goto schedule_time_event;
3255
3256         cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
3257
3258         /*
3259          * Change the PHY context configuration as it is currently referenced
3260          * only by the P2P Device MAC
3261          */
3262         if (mvmvif->phy_ctxt->ref == 1) {
3263                 ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt,
3264                                                &chandef, 1, 1);
3265                 if (ret)
3266                         goto out_unlock;
3267         } else {
3268                 /*
3269                  * The PHY context is shared with other MACs. Need to remove the
3270                  * P2P Device from the binding, allocate an new PHY context and
3271                  * create a new binding
3272                  */
3273                 phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3274                 if (!phy_ctxt) {
3275                         ret = -ENOSPC;
3276                         goto out_unlock;
3277                 }
3278
3279                 ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &chandef,
3280                                                1, 1);
3281                 if (ret) {
3282                         IWL_ERR(mvm, "Failed to change PHY context\n");
3283                         goto out_unlock;
3284                 }
3285
3286                 /* Unbind the P2P_DEVICE from the current PHY context */
3287                 ret = iwl_mvm_binding_remove_vif(mvm, vif);
3288                 if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
3289                         goto out_unlock;
3290
3291                 iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
3292
3293                 /* Bind the P2P_DEVICE to the new allocated PHY context */
3294                 mvmvif->phy_ctxt = phy_ctxt;
3295
3296                 ret = iwl_mvm_binding_add_vif(mvm, vif);
3297                 if (WARN(ret, "Failed binding P2P_DEVICE\n"))
3298                         goto out_unlock;
3299
3300                 iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
3301         }
3302
3303 schedule_time_event:
3304         /* Schedule the time events */
3305         ret = iwl_mvm_start_p2p_roc(mvm, vif, duration, type);
3306
3307 out_unlock:
3308         mutex_unlock(&mvm->mutex);
3309         IWL_DEBUG_MAC80211(mvm, "leave\n");
3310         return ret;
3311 }
3312
3313 static int iwl_mvm_cancel_roc(struct ieee80211_hw *hw)
3314 {
3315         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3316
3317         IWL_DEBUG_MAC80211(mvm, "enter\n");
3318
3319         mutex_lock(&mvm->mutex);
3320         iwl_mvm_stop_roc(mvm);
3321         mutex_unlock(&mvm->mutex);
3322
3323         IWL_DEBUG_MAC80211(mvm, "leave\n");
3324         return 0;
3325 }
3326
3327 static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
3328                                  struct ieee80211_chanctx_conf *ctx)
3329 {
3330         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3331         struct iwl_mvm_phy_ctxt *phy_ctxt;
3332         int ret;
3333
3334         lockdep_assert_held(&mvm->mutex);
3335
3336         IWL_DEBUG_MAC80211(mvm, "Add channel context\n");
3337
3338         phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
3339         if (!phy_ctxt) {
3340                 ret = -ENOSPC;
3341                 goto out;
3342         }
3343
3344         ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
3345                                        ctx->rx_chains_static,
3346                                        ctx->rx_chains_dynamic);
3347         if (ret) {
3348                 IWL_ERR(mvm, "Failed to add PHY context\n");
3349                 goto out;
3350         }
3351
3352         iwl_mvm_phy_ctxt_ref(mvm, phy_ctxt);
3353         *phy_ctxt_id = phy_ctxt->id;
3354 out:
3355         return ret;
3356 }
3357
3358 static int iwl_mvm_add_chanctx(struct ieee80211_hw *hw,
3359                                struct ieee80211_chanctx_conf *ctx)
3360 {
3361         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3362         int ret;
3363
3364         mutex_lock(&mvm->mutex);
3365         ret = __iwl_mvm_add_chanctx(mvm, ctx);
3366         mutex_unlock(&mvm->mutex);
3367
3368         return ret;
3369 }
3370
3371 static void __iwl_mvm_remove_chanctx(struct iwl_mvm *mvm,
3372                                      struct ieee80211_chanctx_conf *ctx)
3373 {
3374         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3375         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3376
3377         lockdep_assert_held(&mvm->mutex);
3378
3379         iwl_mvm_phy_ctxt_unref(mvm, phy_ctxt);
3380 }
3381
3382 static void iwl_mvm_remove_chanctx(struct ieee80211_hw *hw,
3383                                    struct ieee80211_chanctx_conf *ctx)
3384 {
3385         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3386
3387         mutex_lock(&mvm->mutex);
3388         __iwl_mvm_remove_chanctx(mvm, ctx);
3389         mutex_unlock(&mvm->mutex);
3390 }
3391
3392 static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
3393                                    struct ieee80211_chanctx_conf *ctx,
3394                                    u32 changed)
3395 {
3396         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3397         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3398         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3399
3400         if (WARN_ONCE((phy_ctxt->ref > 1) &&
3401                       (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
3402                                    IEEE80211_CHANCTX_CHANGE_RX_CHAINS |
3403                                    IEEE80211_CHANCTX_CHANGE_RADAR |
3404                                    IEEE80211_CHANCTX_CHANGE_MIN_WIDTH)),
3405                       "Cannot change PHY. Ref=%d, changed=0x%X\n",
3406                       phy_ctxt->ref, changed))
3407                 return;
3408
3409         mutex_lock(&mvm->mutex);
3410
3411         /* we are only changing the min_width, may be a noop */
3412         if (changed == IEEE80211_CHANCTX_CHANGE_MIN_WIDTH) {
3413                 if (phy_ctxt->width == ctx->min_def.width)
3414                         goto out_unlock;
3415
3416                 /* we are just toggling between 20_NOHT and 20 */
3417                 if (phy_ctxt->width <= NL80211_CHAN_WIDTH_20 &&
3418                     ctx->min_def.width <= NL80211_CHAN_WIDTH_20)
3419                         goto out_unlock;
3420         }
3421
3422         iwl_mvm_bt_coex_vif_change(mvm);
3423         iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
3424                                  ctx->rx_chains_static,
3425                                  ctx->rx_chains_dynamic);
3426
3427 out_unlock:
3428         mutex_unlock(&mvm->mutex);
3429 }
3430
3431 static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
3432                                         struct ieee80211_vif *vif,
3433                                         struct ieee80211_chanctx_conf *ctx,
3434                                         bool switching_chanctx)
3435 {
3436         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
3437         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
3438         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3439         int ret;
3440
3441         lockdep_assert_held(&mvm->mutex);
3442
3443         mvmvif->phy_ctxt = phy_ctxt;
3444
3445         switch (vif->type) {
3446         case NL80211_IFTYPE_AP:
3447                 /* only needed if we're switching chanctx (i.e. during CSA) */
3448                 if (switching_chanctx) {
3449                         mvmvif->ap_ibss_active = true;
3450                         break;
3451                 }
3452         case NL80211_IFTYPE_ADHOC:
3453                 /*
3454                  * The AP binding flow is handled as part of the start_ap flow
3455                  * (in bss_info_changed), similarly for IBSS.
3456                  */
3457                 ret = 0;
3458                 goto out;
3459         case NL80211_IFTYPE_STATION:
3460                 break;
3461         case NL80211_IFTYPE_MONITOR:
3462                 /* always disable PS when a monitor interface is active */
3463                 mvmvif->ps_disabled = true;
3464                 break;
3465         default:
3466                 ret = -EINVAL;
3467                 goto out;
3468         }
3469
3470         ret = iwl_mvm_binding_add_vif(mvm, vif);
3471         if (ret)
3472                 goto out;
3473
3474         /*
3475          * Power state must be updated before quotas,
3476          * otherwise fw will complain.
3477          */
3478         iwl_mvm_power_update_mac(mvm);
3479
3480         /* Setting the quota at this stage is only required for monitor
3481          * interfaces. For the other types, the bss_info changed flow
3482          * will handle quota settings.
3483          */
3484         if (vif->type == NL80211_IFTYPE_MONITOR) {
3485                 mvmvif->monitor_active = true;
3486                 ret = iwl_mvm_update_quotas(mvm, false, NULL);
3487                 if (ret)
3488                         goto out_remove_binding;
3489
3490                 ret = iwl_mvm_add_snif_sta(mvm, vif);
3491                 if (ret)
3492                         goto out_remove_binding;
3493
3494         }
3495
3496         /* Handle binding during CSA */
3497         if (vif->type == NL80211_IFTYPE_AP) {
3498                 iwl_mvm_update_quotas(mvm, false, NULL);
3499                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3500         }
3501
3502         if (switching_chanctx && vif->type == NL80211_IFTYPE_STATION) {
3503                 u32 duration = 2 * vif->bss_conf.beacon_int;
3504
3505                 /* iwl_mvm_protect_session() reads directly from the
3506                  * device (the system time), so make sure it is
3507                  * available.
3508                  */
3509                 ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PROTECT_CSA);
3510                 if (ret)
3511                         goto out_remove_binding;
3512
3513                 /* Protect the session to make sure we hear the first
3514                  * beacon on the new channel.
3515                  */
3516                 iwl_mvm_protect_session(mvm, vif, duration, duration,
3517                                         vif->bss_conf.beacon_int / 2,
3518                                         true);
3519
3520                 iwl_mvm_unref(mvm, IWL_MVM_REF_PROTECT_CSA);
3521
3522                 iwl_mvm_update_quotas(mvm, false, NULL);
3523         }
3524
3525         goto out;
3526
3527 out_remove_binding:
3528         iwl_mvm_binding_remove_vif(mvm, vif);
3529         iwl_mvm_power_update_mac(mvm);
3530 out:
3531         if (ret)
3532                 mvmvif->phy_ctxt = NULL;
3533         return ret;
3534 }
3535 static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
3536                                       struct ieee80211_vif *vif,
3537                                       struct ieee80211_chanctx_conf *ctx)
3538 {
3539         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3540         int ret;
3541
3542         mutex_lock(&mvm->mutex);
3543         ret = __iwl_mvm_assign_vif_chanctx(mvm, vif, ctx, false);
3544         mutex_unlock(&mvm->mutex);
3545
3546         return ret;
3547 }
3548
3549 static void __iwl_mvm_unassign_vif_chanctx(struct iwl_mvm *mvm,
3550                                            struct ieee80211_vif *vif,
3551                                            struct ieee80211_chanctx_conf *ctx,
3552                                            bool switching_chanctx)
3553 {
3554         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3555         struct ieee80211_vif *disabled_vif = NULL;
3556
3557         lockdep_assert_held(&mvm->mutex);
3558
3559         iwl_mvm_remove_time_event(mvm, mvmvif, &mvmvif->time_event_data);
3560
3561         switch (vif->type) {
3562         case NL80211_IFTYPE_ADHOC:
3563                 goto out;
3564         case NL80211_IFTYPE_MONITOR:
3565                 mvmvif->monitor_active = false;
3566                 mvmvif->ps_disabled = false;
3567                 iwl_mvm_rm_snif_sta(mvm, vif);
3568                 break;
3569         case NL80211_IFTYPE_AP:
3570                 /* This part is triggered only during CSA */
3571                 if (!switching_chanctx || !mvmvif->ap_ibss_active)
3572                         goto out;
3573
3574                 mvmvif->csa_countdown = false;
3575
3576                 /* Set CS bit on all the stations */
3577                 iwl_mvm_modify_all_sta_disable_tx(mvm, mvmvif, true);
3578
3579                 /* Save blocked iface, the timeout is set on the next beacon */
3580                 rcu_assign_pointer(mvm->csa_tx_blocked_vif, vif);
3581
3582                 mvmvif->ap_ibss_active = false;
3583                 break;
3584         case NL80211_IFTYPE_STATION:
3585                 if (!switching_chanctx)
3586                         break;
3587
3588                 disabled_vif = vif;
3589
3590                 iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
3591                 break;
3592         default:
3593                 break;
3594         }
3595
3596         iwl_mvm_update_quotas(mvm, false, disabled_vif);
3597         iwl_mvm_binding_remove_vif(mvm, vif);
3598
3599 out:
3600         mvmvif->phy_ctxt = NULL;
3601         iwl_mvm_power_update_mac(mvm);
3602 }
3603
3604 static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
3605                                          struct ieee80211_vif *vif,
3606                                          struct ieee80211_chanctx_conf *ctx)
3607 {
3608         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3609
3610         mutex_lock(&mvm->mutex);
3611         __iwl_mvm_unassign_vif_chanctx(mvm, vif, ctx, false);
3612         mutex_unlock(&mvm->mutex);
3613 }
3614
3615 static int
3616 iwl_mvm_switch_vif_chanctx_swap(struct iwl_mvm *mvm,
3617                                 struct ieee80211_vif_chanctx_switch *vifs)
3618 {
3619         int ret;
3620
3621         mutex_lock(&mvm->mutex);
3622         __iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
3623         __iwl_mvm_remove_chanctx(mvm, vifs[0].old_ctx);
3624
3625         ret = __iwl_mvm_add_chanctx(mvm, vifs[0].new_ctx);
3626         if (ret) {
3627                 IWL_ERR(mvm, "failed to add new_ctx during channel switch\n");
3628                 goto out_reassign;
3629         }
3630
3631         ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
3632                                            true);
3633         if (ret) {
3634                 IWL_ERR(mvm,
3635                         "failed to assign new_ctx during channel switch\n");
3636                 goto out_remove;
3637         }
3638
3639         /* we don't support TDLS during DCM - can be caused by channel switch */
3640         if (iwl_mvm_phy_ctx_count(mvm) > 1)
3641                 iwl_mvm_teardown_tdls_peers(mvm);
3642
3643         goto out;
3644
3645 out_remove:
3646         __iwl_mvm_remove_chanctx(mvm, vifs[0].new_ctx);
3647
3648 out_reassign:
3649         if (__iwl_mvm_add_chanctx(mvm, vifs[0].old_ctx)) {
3650                 IWL_ERR(mvm, "failed to add old_ctx back after failure.\n");
3651                 goto out_restart;
3652         }
3653
3654         if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
3655                                          true)) {
3656                 IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
3657                 goto out_restart;
3658         }
3659
3660         goto out;
3661
3662 out_restart:
3663         /* things keep failing, better restart the hw */
3664         iwl_mvm_nic_restart(mvm, false);
3665
3666 out:
3667         mutex_unlock(&mvm->mutex);
3668
3669         return ret;
3670 }
3671
3672 static int
3673 iwl_mvm_switch_vif_chanctx_reassign(struct iwl_mvm *mvm,
3674                                     struct ieee80211_vif_chanctx_switch *vifs)
3675 {
3676         int ret;
3677
3678         mutex_lock(&mvm->mutex);
3679         __iwl_mvm_unassign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx, true);
3680
3681         ret = __iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].new_ctx,
3682                                            true);
3683         if (ret) {
3684                 IWL_ERR(mvm,
3685                         "failed to assign new_ctx during channel switch\n");
3686                 goto out_reassign;
3687         }
3688
3689         goto out;
3690
3691 out_reassign:
3692         if (__iwl_mvm_assign_vif_chanctx(mvm, vifs[0].vif, vifs[0].old_ctx,
3693                                          true)) {
3694                 IWL_ERR(mvm, "failed to reassign old_ctx after failure.\n");
3695                 goto out_restart;
3696         }
3697
3698         goto out;
3699
3700 out_restart:
3701         /* things keep failing, better restart the hw */
3702         iwl_mvm_nic_restart(mvm, false);
3703
3704 out:
3705         mutex_unlock(&mvm->mutex);
3706
3707         return ret;
3708 }
3709
3710 static int iwl_mvm_switch_vif_chanctx(struct ieee80211_hw *hw,
3711                                       struct ieee80211_vif_chanctx_switch *vifs,
3712                                       int n_vifs,
3713                                       enum ieee80211_chanctx_switch_mode mode)
3714 {
3715         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3716         int ret;
3717
3718         /* we only support a single-vif right now */
3719         if (n_vifs > 1)
3720                 return -EOPNOTSUPP;
3721
3722         switch (mode) {
3723         case CHANCTX_SWMODE_SWAP_CONTEXTS:
3724                 ret = iwl_mvm_switch_vif_chanctx_swap(mvm, vifs);
3725                 break;
3726         case CHANCTX_SWMODE_REASSIGN_VIF:
3727                 ret = iwl_mvm_switch_vif_chanctx_reassign(mvm, vifs);
3728                 break;
3729         default:
3730                 ret = -EOPNOTSUPP;
3731                 break;
3732         }
3733
3734         return ret;
3735 }
3736
3737 static int iwl_mvm_tx_last_beacon(struct ieee80211_hw *hw)
3738 {
3739         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3740
3741         return mvm->ibss_manager;
3742 }
3743
3744 static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
3745                            struct ieee80211_sta *sta,
3746                            bool set)
3747 {
3748         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3749         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
3750
3751         if (!mvm_sta || !mvm_sta->vif) {
3752                 IWL_ERR(mvm, "Station is not associated to a vif\n");
3753                 return -EINVAL;
3754         }
3755
3756         return iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm_sta->vif);
3757 }
3758
3759 #ifdef CONFIG_NL80211_TESTMODE
3760 static const struct nla_policy iwl_mvm_tm_policy[IWL_MVM_TM_ATTR_MAX + 1] = {
3761         [IWL_MVM_TM_ATTR_CMD] = { .type = NLA_U32 },
3762         [IWL_MVM_TM_ATTR_NOA_DURATION] = { .type = NLA_U32 },
3763         [IWL_MVM_TM_ATTR_BEACON_FILTER_STATE] = { .type = NLA_U32 },
3764 };
3765
3766 static int __iwl_mvm_mac_testmode_cmd(struct iwl_mvm *mvm,
3767                                       struct ieee80211_vif *vif,
3768                                       void *data, int len)
3769 {
3770         struct nlattr *tb[IWL_MVM_TM_ATTR_MAX + 1];
3771         int err;
3772         u32 noa_duration;
3773
3774         err = nla_parse(tb, IWL_MVM_TM_ATTR_MAX, data, len, iwl_mvm_tm_policy,
3775                         NULL);
3776         if (err)
3777                 return err;
3778
3779         if (!tb[IWL_MVM_TM_ATTR_CMD])
3780                 return -EINVAL;
3781
3782         switch (nla_get_u32(tb[IWL_MVM_TM_ATTR_CMD])) {
3783         case IWL_MVM_TM_CMD_SET_NOA:
3784                 if (!vif || vif->type != NL80211_IFTYPE_AP || !vif->p2p ||
3785                     !vif->bss_conf.enable_beacon ||
3786                     !tb[IWL_MVM_TM_ATTR_NOA_DURATION])
3787                         return -EINVAL;
3788
3789                 noa_duration = nla_get_u32(tb[IWL_MVM_TM_ATTR_NOA_DURATION]);
3790                 if (noa_duration >= vif->bss_conf.beacon_int)
3791                         return -EINVAL;
3792
3793                 mvm->noa_duration = noa_duration;
3794                 mvm->noa_vif = vif;
3795
3796                 return iwl_mvm_update_quotas(mvm, false, NULL);
3797         case IWL_MVM_TM_CMD_SET_BEACON_FILTER:
3798                 /* must be associated client vif - ignore authorized */
3799                 if (!vif || vif->type != NL80211_IFTYPE_STATION ||
3800                     !vif->bss_conf.assoc || !vif->bss_conf.dtim_period ||
3801                     !tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE])
3802                         return -EINVAL;
3803
3804                 if (nla_get_u32(tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE]))
3805                         return iwl_mvm_enable_beacon_filter(mvm, vif, 0);
3806                 return iwl_mvm_disable_beacon_filter(mvm, vif, 0);
3807         }
3808
3809         return -EOPNOTSUPP;
3810 }
3811
3812 static int iwl_mvm_mac_testmode_cmd(struct ieee80211_hw *hw,
3813                                     struct ieee80211_vif *vif,
3814                                     void *data, int len)
3815 {
3816         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3817         int err;
3818
3819         mutex_lock(&mvm->mutex);
3820         err = __iwl_mvm_mac_testmode_cmd(mvm, vif, data, len);
3821         mutex_unlock(&mvm->mutex);
3822
3823         return err;
3824 }
3825 #endif
3826
3827 static void iwl_mvm_channel_switch(struct ieee80211_hw *hw,
3828                                    struct ieee80211_vif *vif,
3829                                    struct ieee80211_channel_switch *chsw)
3830 {
3831         /* By implementing this operation, we prevent mac80211 from
3832          * starting its own channel switch timer, so that we can call
3833          * ieee80211_chswitch_done() ourselves at the right time
3834          * (which is when the absence time event starts).
3835          */
3836
3837         IWL_DEBUG_MAC80211(IWL_MAC80211_GET_MVM(hw),
3838                            "dummy channel switch op\n");
3839 }
3840
3841 static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
3842                                       struct ieee80211_vif *vif,
3843                                       struct ieee80211_channel_switch *chsw)
3844 {
3845         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3846         struct ieee80211_vif *csa_vif;
3847         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3848         u32 apply_time;
3849         int ret;
3850
3851         mutex_lock(&mvm->mutex);
3852
3853         mvmvif->csa_failed = false;
3854
3855         IWL_DEBUG_MAC80211(mvm, "pre CSA to freq %d\n",
3856                            chsw->chandef.center_freq1);
3857
3858         iwl_fw_dbg_trigger_simple_stop(&mvm->fwrt,
3859                                        ieee80211_vif_to_wdev(vif),
3860                                        FW_DBG_TRIGGER_CHANNEL_SWITCH);
3861
3862         switch (vif->type) {
3863         case NL80211_IFTYPE_AP:
3864                 csa_vif =
3865                         rcu_dereference_protected(mvm->csa_vif,
3866                                                   lockdep_is_held(&mvm->mutex));
3867                 if (WARN_ONCE(csa_vif && csa_vif->csa_active,
3868                               "Another CSA is already in progress")) {
3869                         ret = -EBUSY;
3870                         goto out_unlock;
3871                 }
3872
3873                 /* we still didn't unblock tx. prevent new CS meanwhile */
3874                 if (rcu_dereference_protected(mvm->csa_tx_blocked_vif,
3875                                               lockdep_is_held(&mvm->mutex))) {
3876                         ret = -EBUSY;
3877                         goto out_unlock;
3878                 }
3879
3880                 rcu_assign_pointer(mvm->csa_vif, vif);
3881
3882                 if (WARN_ONCE(mvmvif->csa_countdown,
3883                               "Previous CSA countdown didn't complete")) {
3884                         ret = -EBUSY;
3885                         goto out_unlock;
3886                 }
3887
3888                 mvmvif->csa_target_freq = chsw->chandef.chan->center_freq;
3889
3890                 break;
3891         case NL80211_IFTYPE_STATION:
3892                 /* Schedule the time event to a bit before beacon 1,
3893                  * to make sure we're in the new channel when the
3894                  * GO/AP arrives. In case count <= 1 immediately schedule the
3895                  * TE (this might result with some packet loss or connection
3896                  * loss).
3897                  */
3898                 if (chsw->count <= 1)
3899                         apply_time = 0;
3900                 else
3901                         apply_time = chsw->device_timestamp +
3902                                 ((vif->bss_conf.beacon_int * (chsw->count - 1) -
3903                                   IWL_MVM_CHANNEL_SWITCH_TIME_CLIENT) * 1024);
3904
3905                 if (chsw->block_tx)
3906                         iwl_mvm_csa_client_absent(mvm, vif);
3907
3908                 iwl_mvm_schedule_csa_period(mvm, vif, vif->bss_conf.beacon_int,
3909                                             apply_time);
3910                 if (mvmvif->bf_data.bf_enabled) {
3911                         ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
3912                         if (ret)
3913                                 goto out_unlock;
3914                 }
3915
3916                 break;
3917         default:
3918                 break;
3919         }
3920
3921         mvmvif->ps_disabled = true;
3922
3923         ret = iwl_mvm_power_update_ps(mvm);
3924         if (ret)
3925                 goto out_unlock;
3926
3927         /* we won't be on this channel any longer */
3928         iwl_mvm_teardown_tdls_peers(mvm);
3929
3930 out_unlock:
3931         mutex_unlock(&mvm->mutex);
3932
3933         return ret;
3934 }
3935
3936 static int iwl_mvm_post_channel_switch(struct ieee80211_hw *hw,
3937                                        struct ieee80211_vif *vif)
3938 {
3939         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
3940         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
3941         int ret;
3942
3943         mutex_lock(&mvm->mutex);
3944
3945         if (mvmvif->csa_failed) {
3946                 mvmvif->csa_failed = false;
3947                 ret = -EIO;
3948                 goto out_unlock;
3949         }
3950
3951         if (vif->type == NL80211_IFTYPE_STATION) {
3952                 struct iwl_mvm_sta *mvmsta;
3953
3954                 mvmsta = iwl_mvm_sta_from_staid_protected(mvm,
3955                                                           mvmvif->ap_sta_id);
3956
3957                 if (WARN_ON(!mvmsta)) {
3958                         ret = -EIO;
3959                         goto out_unlock;
3960                 }
3961
3962                 iwl_mvm_sta_modify_disable_tx(mvm, mvmsta, false);
3963
3964                 iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
3965
3966                 ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
3967                 if (ret)
3968                         goto out_unlock;
3969
3970                 iwl_mvm_stop_session_protection(mvm, vif);
3971         }
3972
3973         mvmvif->ps_disabled = false;
3974
3975         ret = iwl_mvm_power_update_ps(mvm);
3976
3977 out_unlock:
3978         mutex_unlock(&mvm->mutex);
3979
3980         return ret;
3981 }
3982
3983 static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
3984 {
3985         int i;
3986
3987         if (!iwl_mvm_has_new_tx_api(mvm)) {
3988                 if (drop) {
3989                         mutex_lock(&mvm->mutex);
3990                         iwl_mvm_flush_tx_path(mvm,
3991                                 iwl_mvm_flushable_queues(mvm) & queues, 0);
3992                         mutex_unlock(&mvm->mutex);
3993                 } else {
3994                         iwl_trans_wait_tx_queues_empty(mvm->trans, queues);
3995                 }
3996                 return;
3997         }
3998
3999         mutex_lock(&mvm->mutex);
4000         for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4001                 struct ieee80211_sta *sta;
4002
4003                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4004                                                 lockdep_is_held(&mvm->mutex));
4005                 if (IS_ERR_OR_NULL(sta))
4006                         continue;
4007
4008                 if (drop)
4009                         iwl_mvm_flush_sta_tids(mvm, i, 0xFF, 0);
4010                 else
4011                         iwl_mvm_wait_sta_queues_empty(mvm,
4012                                         iwl_mvm_sta_from_mac80211(sta));
4013         }
4014         mutex_unlock(&mvm->mutex);
4015 }
4016
4017 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
4018                               struct ieee80211_vif *vif, u32 queues, bool drop)
4019 {
4020         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4021         struct iwl_mvm_vif *mvmvif;
4022         struct iwl_mvm_sta *mvmsta;
4023         struct ieee80211_sta *sta;
4024         int i;
4025         u32 msk = 0;
4026
4027         if (!vif) {
4028                 iwl_mvm_flush_no_vif(mvm, queues, drop);
4029                 return;
4030         }
4031
4032         if (vif->type != NL80211_IFTYPE_STATION)
4033                 return;
4034
4035         /* Make sure we're done with the deferred traffic before flushing */
4036         flush_work(&mvm->add_stream_wk);
4037
4038         mutex_lock(&mvm->mutex);
4039         mvmvif = iwl_mvm_vif_from_mac80211(vif);
4040
4041         /* flush the AP-station and all TDLS peers */
4042         for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
4043                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
4044                                                 lockdep_is_held(&mvm->mutex));
4045                 if (IS_ERR_OR_NULL(sta))
4046                         continue;
4047
4048                 mvmsta = iwl_mvm_sta_from_mac80211(sta);
4049                 if (mvmsta->vif != vif)
4050                         continue;
4051
4052                 /* make sure only TDLS peers or the AP are flushed */
4053                 WARN_ON(i != mvmvif->ap_sta_id && !sta->tdls);
4054
4055                 if (drop) {
4056                         if (iwl_mvm_flush_sta(mvm, mvmsta, false, 0))
4057                                 IWL_ERR(mvm, "flush request fail\n");
4058                 } else {
4059                         msk |= mvmsta->tfd_queue_msk;
4060                         if (iwl_mvm_has_new_tx_api(mvm))
4061                                 iwl_mvm_wait_sta_queues_empty(mvm, mvmsta);
4062                 }
4063         }
4064
4065         mutex_unlock(&mvm->mutex);
4066
4067         /* this can take a while, and we may need/want other operations
4068          * to succeed while doing this, so do it without the mutex held
4069          */
4070         if (!drop && !iwl_mvm_has_new_tx_api(mvm))
4071                 iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
4072 }
4073
4074 static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
4075                                   struct survey_info *survey)
4076 {
4077         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4078         int ret;
4079
4080         memset(survey, 0, sizeof(*survey));
4081
4082         /* only support global statistics right now */
4083         if (idx != 0)
4084                 return -ENOENT;
4085
4086         if (!fw_has_capa(&mvm->fw->ucode_capa,
4087                          IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
4088                 return -ENOENT;
4089
4090         mutex_lock(&mvm->mutex);
4091
4092         if (iwl_mvm_firmware_running(mvm)) {
4093                 ret = iwl_mvm_request_statistics(mvm, false);
4094                 if (ret)
4095                         goto out;
4096         }
4097
4098         survey->filled = SURVEY_INFO_TIME |
4099                          SURVEY_INFO_TIME_RX |
4100                          SURVEY_INFO_TIME_TX |
4101                          SURVEY_INFO_TIME_SCAN;
4102         survey->time = mvm->accu_radio_stats.on_time_rf +
4103                        mvm->radio_stats.on_time_rf;
4104         do_div(survey->time, USEC_PER_MSEC);
4105
4106         survey->time_rx = mvm->accu_radio_stats.rx_time +
4107                           mvm->radio_stats.rx_time;
4108         do_div(survey->time_rx, USEC_PER_MSEC);
4109
4110         survey->time_tx = mvm->accu_radio_stats.tx_time +
4111                           mvm->radio_stats.tx_time;
4112         do_div(survey->time_tx, USEC_PER_MSEC);
4113
4114         survey->time_scan = mvm->accu_radio_stats.on_time_scan +
4115                             mvm->radio_stats.on_time_scan;
4116         do_div(survey->time_scan, USEC_PER_MSEC);
4117
4118         ret = 0;
4119  out:
4120         mutex_unlock(&mvm->mutex);
4121         return ret;
4122 }
4123
4124 static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
4125                                        struct ieee80211_vif *vif,
4126                                        struct ieee80211_sta *sta,
4127                                        struct station_info *sinfo)
4128 {
4129         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4130         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
4131         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
4132
4133         if (mvmsta->avg_energy) {
4134                 sinfo->signal_avg = mvmsta->avg_energy;
4135                 sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL_AVG);
4136         }
4137
4138         if (!fw_has_capa(&mvm->fw->ucode_capa,
4139                          IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
4140                 return;
4141
4142         /* if beacon filtering isn't on mac80211 does it anyway */
4143         if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
4144                 return;
4145
4146         if (!vif->bss_conf.assoc)
4147                 return;
4148
4149         mutex_lock(&mvm->mutex);
4150
4151         if (mvmvif->ap_sta_id != mvmsta->sta_id)
4152                 goto unlock;
4153
4154         if (iwl_mvm_request_statistics(mvm, false))
4155                 goto unlock;
4156
4157         sinfo->rx_beacon = mvmvif->beacon_stats.num_beacons +
4158                            mvmvif->beacon_stats.accu_num_beacons;
4159         sinfo->filled |= BIT(NL80211_STA_INFO_BEACON_RX);
4160         if (mvmvif->beacon_stats.avg_signal) {
4161                 /* firmware only reports a value after RXing a few beacons */
4162                 sinfo->rx_beacon_signal_avg = mvmvif->beacon_stats.avg_signal;
4163                 sinfo->filled |= BIT(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
4164         }
4165  unlock:
4166         mutex_unlock(&mvm->mutex);
4167 }
4168
4169 static void iwl_mvm_event_mlme_callback(struct iwl_mvm *mvm,
4170                                         struct ieee80211_vif *vif,
4171                                         const struct ieee80211_event *event)
4172 {
4173 #define CHECK_MLME_TRIGGER(_cnt, _fmt...)                               \
4174         do {                                                            \
4175                 if ((trig_mlme->_cnt) && --(trig_mlme->_cnt))           \
4176                         break;                                          \
4177                 iwl_fw_dbg_collect_trig(&(mvm)->fwrt, trig, _fmt);      \
4178         } while (0)
4179
4180         struct iwl_fw_dbg_trigger_tlv *trig;
4181         struct iwl_fw_dbg_trigger_mlme *trig_mlme;
4182
4183         if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_MLME))
4184                 return;
4185
4186         trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_MLME);
4187         trig_mlme = (void *)trig->data;
4188         if (!iwl_fw_dbg_trigger_check_stop(&mvm->fwrt,
4189                                            ieee80211_vif_to_wdev(vif), trig))
4190                 return;
4191
4192         if (event->u.mlme.data == ASSOC_EVENT) {
4193                 if (event->u.mlme.status == MLME_DENIED)
4194                         CHECK_MLME_TRIGGER(stop_assoc_denied,
4195                                            "DENIED ASSOC: reason %d",
4196                                             event->u.mlme.reason);
4197                 else if (event->u.mlme.status == MLME_TIMEOUT)
4198                         CHECK_MLME_TRIGGER(stop_assoc_timeout,
4199                                            "ASSOC TIMEOUT");
4200         } else if (event->u.mlme.data == AUTH_EVENT) {
4201                 if (event->u.mlme.status == MLME_DENIED)
4202                         CHECK_MLME_TRIGGER(stop_auth_denied,
4203                                            "DENIED AUTH: reason %d",
4204                                            event->u.mlme.reason);
4205                 else if (event->u.mlme.status == MLME_TIMEOUT)
4206                         CHECK_MLME_TRIGGER(stop_auth_timeout,
4207                                            "AUTH TIMEOUT");
4208         } else if (event->u.mlme.data == DEAUTH_RX_EVENT) {
4209                 CHECK_MLME_TRIGGER(stop_rx_deauth,
4210                                    "DEAUTH RX %d", event->u.mlme.reason);
4211         } else if (event->u.mlme.data == DEAUTH_TX_EVENT) {
4212                 CHECK_MLME_TRIGGER(stop_tx_deauth,
4213                                    "DEAUTH TX %d", event->u.mlme.reason);
4214         }
4215 #undef CHECK_MLME_TRIGGER
4216 }
4217
4218 static void iwl_mvm_event_bar_rx_callback(struct iwl_mvm *mvm,
4219                                           struct ieee80211_vif *vif,
4220                                           const struct ieee80211_event *event)
4221 {
4222         struct iwl_fw_dbg_trigger_tlv *trig;
4223         struct iwl_fw_dbg_trigger_ba *ba_trig;
4224
4225         if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_BA))
4226                 return;
4227
4228         trig = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_BA);
4229         ba_trig = (void *)trig->data;
4230         if (!iwl_fw_dbg_trigger_check_stop(&mvm->fwrt,
4231                                            ieee80211_vif_to_wdev(vif), trig))
4232                 return;
4233
4234         if (!(le16_to_cpu(ba_trig->rx_bar) & BIT(event->u.ba.tid)))
4235                 return;
4236
4237         iwl_fw_dbg_collect_trig(&mvm->fwrt, trig,
4238                                 "BAR received from %pM, tid %d, ssn %d",
4239                                 event->u.ba.sta->addr, event->u.ba.tid,
4240                                 event->u.ba.ssn);
4241 }
4242
4243 static void iwl_mvm_mac_event_callback(struct ieee80211_hw *hw,
4244                                        struct ieee80211_vif *vif,
4245                                        const struct ieee80211_event *event)
4246 {
4247         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4248
4249         switch (event->type) {
4250         case MLME_EVENT:
4251                 iwl_mvm_event_mlme_callback(mvm, vif, event);
4252                 break;
4253         case BAR_RX_EVENT:
4254                 iwl_mvm_event_bar_rx_callback(mvm, vif, event);
4255                 break;
4256         case BA_FRAME_TIMEOUT:
4257                 iwl_mvm_event_frame_timeout_callback(mvm, vif, event->u.ba.sta,
4258                                                      event->u.ba.tid);
4259                 break;
4260         default:
4261                 break;
4262         }
4263 }
4264
4265 void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
4266                                      struct iwl_mvm_internal_rxq_notif *notif,
4267                                      u32 size)
4268 {
4269         u32 qmask = BIT(mvm->trans->num_rx_queues) - 1;
4270         int ret;
4271
4272         lockdep_assert_held(&mvm->mutex);
4273
4274         if (!iwl_mvm_has_new_rx_api(mvm))
4275                 return;
4276
4277         notif->cookie = mvm->queue_sync_cookie;
4278
4279         if (notif->sync)
4280                 atomic_set(&mvm->queue_sync_counter,
4281                            mvm->trans->num_rx_queues);
4282
4283         /* TODO - remove this when we have RXQ config API */
4284         if (mvm->trans->cfg->device_family == IWL_DEVICE_FAMILY_A000) {
4285                 qmask = BIT(0);
4286                 if (notif->sync)
4287                         atomic_set(&mvm->queue_sync_counter, 1);
4288         }
4289
4290         ret = iwl_mvm_notify_rx_queue(mvm, qmask, (u8 *)notif, size);
4291         if (ret) {
4292                 IWL_ERR(mvm, "Failed to trigger RX queues sync (%d)\n", ret);
4293                 goto out;
4294         }
4295
4296         if (notif->sync) {
4297                 ret = wait_event_timeout(mvm->rx_sync_waitq,
4298                                          atomic_read(&mvm->queue_sync_counter) == 0 ||
4299                                          iwl_mvm_is_radio_killed(mvm),
4300                                          HZ);
4301                 WARN_ON_ONCE(!ret && !iwl_mvm_is_radio_killed(mvm));
4302         }
4303
4304 out:
4305         atomic_set(&mvm->queue_sync_counter, 0);
4306         mvm->queue_sync_cookie++;
4307 }
4308
4309 static void iwl_mvm_sync_rx_queues(struct ieee80211_hw *hw)
4310 {
4311         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
4312         struct iwl_mvm_internal_rxq_notif data = {
4313                 .type = IWL_MVM_RXQ_EMPTY,
4314                 .sync = 1,
4315         };
4316
4317         mutex_lock(&mvm->mutex);
4318         iwl_mvm_sync_rx_queues_internal(mvm, &data, sizeof(data));
4319         mutex_unlock(&mvm->mutex);
4320 }
4321
4322 const struct ieee80211_ops iwl_mvm_hw_ops = {
4323         .tx = iwl_mvm_mac_tx,
4324         .ampdu_action = iwl_mvm_mac_ampdu_action,
4325         .start = iwl_mvm_mac_start,
4326         .reconfig_complete = iwl_mvm_mac_reconfig_complete,
4327         .stop = iwl_mvm_mac_stop,
4328         .add_interface = iwl_mvm_mac_add_interface,
4329         .remove_interface = iwl_mvm_mac_remove_interface,
4330         .config = iwl_mvm_mac_config,
4331         .prepare_multicast = iwl_mvm_prepare_multicast,
4332         .configure_filter = iwl_mvm_configure_filter,
4333         .config_iface_filter = iwl_mvm_config_iface_filter,
4334         .bss_info_changed = iwl_mvm_bss_info_changed,
4335         .hw_scan = iwl_mvm_mac_hw_scan,
4336         .cancel_hw_scan = iwl_mvm_mac_cancel_hw_scan,
4337         .sta_pre_rcu_remove = iwl_mvm_sta_pre_rcu_remove,
4338         .sta_state = iwl_mvm_mac_sta_state,
4339         .sta_notify = iwl_mvm_mac_sta_notify,
4340         .allow_buffered_frames = iwl_mvm_mac_allow_buffered_frames,
4341         .release_buffered_frames = iwl_mvm_mac_release_buffered_frames,
4342         .set_rts_threshold = iwl_mvm_mac_set_rts_threshold,
4343         .sta_rc_update = iwl_mvm_sta_rc_update,
4344         .conf_tx = iwl_mvm_mac_conf_tx,
4345         .mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
4346         .mgd_protect_tdls_discover = iwl_mvm_mac_mgd_protect_tdls_discover,
4347         .flush = iwl_mvm_mac_flush,
4348         .sched_scan_start = iwl_mvm_mac_sched_scan_start,
4349         .sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
4350         .set_key = iwl_mvm_mac_set_key,
4351         .update_tkip_key = iwl_mvm_mac_update_tkip_key,
4352         .remain_on_channel = iwl_mvm_roc,
4353         .cancel_remain_on_channel = iwl_mvm_cancel_roc,
4354         .add_chanctx = iwl_mvm_add_chanctx,
4355         .remove_chanctx = iwl_mvm_remove_chanctx,
4356         .change_chanctx = iwl_mvm_change_chanctx,
4357         .assign_vif_chanctx = iwl_mvm_assign_vif_chanctx,
4358         .unassign_vif_chanctx = iwl_mvm_unassign_vif_chanctx,
4359         .switch_vif_chanctx = iwl_mvm_switch_vif_chanctx,
4360
4361         .start_ap = iwl_mvm_start_ap_ibss,
4362         .stop_ap = iwl_mvm_stop_ap_ibss,
4363         .join_ibss = iwl_mvm_start_ap_ibss,
4364         .leave_ibss = iwl_mvm_stop_ap_ibss,
4365
4366         .tx_last_beacon = iwl_mvm_tx_last_beacon,
4367
4368         .set_tim = iwl_mvm_set_tim,
4369
4370         .channel_switch = iwl_mvm_channel_switch,
4371         .pre_channel_switch = iwl_mvm_pre_channel_switch,
4372         .post_channel_switch = iwl_mvm_post_channel_switch,
4373
4374         .tdls_channel_switch = iwl_mvm_tdls_channel_switch,
4375         .tdls_cancel_channel_switch = iwl_mvm_tdls_cancel_channel_switch,
4376         .tdls_recv_channel_switch = iwl_mvm_tdls_recv_channel_switch,
4377
4378         .event_callback = iwl_mvm_mac_event_callback,
4379
4380         .sync_rx_queues = iwl_mvm_sync_rx_queues,
4381
4382         CFG80211_TESTMODE_CMD(iwl_mvm_mac_testmode_cmd)
4383
4384 #ifdef CONFIG_PM_SLEEP
4385         /* look at d3.c */
4386         .suspend = iwl_mvm_suspend,
4387         .resume = iwl_mvm_resume,
4388         .set_wakeup = iwl_mvm_set_wakeup,
4389         .set_rekey_data = iwl_mvm_set_rekey_data,
4390 #if IS_ENABLED(CONFIG_IPV6)
4391         .ipv6_addr_change = iwl_mvm_ipv6_addr_change,
4392 #endif
4393         .set_default_unicast_key = iwl_mvm_set_default_unicast_key,
4394 #endif
4395         .get_survey = iwl_mvm_mac_get_survey,
4396         .sta_statistics = iwl_mvm_mac_sta_statistics,
4397 };