drivers/net/wireless/intel/iwlwifi/mvm/sta.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2012 - 2015 Intel Corporation. All rights reserved.
   9  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  10  * Copyright(c) 2016 Intel Deutschland GmbH
  11  *
  12  * This program is free software; you can redistribute it and/or modify
  13  * it under the terms of version 2 of the GNU General Public License as
  14  * published by the Free Software Foundation.
  15  *
  16  * This program is distributed in the hope that it will be useful, but
  17  * WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  19  * General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  24  * USA
  25  *
  26  * The full GNU General Public License is included in this distribution
  27  * in the file called COPYING.
  28  *
  29  * Contact Information:
  30  *  Intel Linux Wireless <linuxwifi@intel.com>
  31  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  32  *
  33  * BSD LICENSE
  34  *
  35  * Copyright(c) 2012 - 2015 Intel Corporation. All rights reserved.
  36  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  37  * Copyright(c) 2016 Intel Deutschland GmbH
  38  * All rights reserved.
  39  *
  40  * Redistribution and use in source and binary forms, with or without
  41  * modification, are permitted provided that the following conditions
  42  * are met:
  43  *
  44  *  * Redistributions of source code must retain the above copyright
  45  *    notice, this list of conditions and the following disclaimer.
  46  *  * Redistributions in binary form must reproduce the above copyright
  47  *    notice, this list of conditions and the following disclaimer in
  48  *    the documentation and/or other materials provided with the
  49  *    distribution.
  50  *  * Neither the name Intel Corporation nor the names of its
  51  *    contributors may be used to endorse or promote products derived
  52  *    from this software without specific prior written permission.
  53  *
  54  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  55  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  56  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  57  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  58  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  59  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  60  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  61  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  62  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  63  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  64  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  65  *
  66  *****************************************************************************/
  67 #include <net/mac80211.h>
  68
  69 #include "mvm.h"
  70 #include "sta.h"
  71 #include "rs.h"
  72
  73 /*
  74  * New version of ADD_STA_sta command added new fields at the end of the
  75  * structure, so sending the size of the relevant API's structure is enough to
  76  * support both API versions.
  77  */
  78 static inline int iwl_mvm_add_sta_cmd_size(struct iwl_mvm *mvm)
  79 {
  80         return iwl_mvm_has_new_rx_api(mvm) ?
  81                 sizeof(struct iwl_mvm_add_sta_cmd) :
  82                 sizeof(struct iwl_mvm_add_sta_cmd_v7);
  83 }
  84
  85 static int iwl_mvm_find_free_sta_id(struct iwl_mvm *mvm,
  86                                     enum nl80211_iftype iftype)
  87 {
  88         int sta_id;
  89         u32 reserved_ids = 0;
  90
  91         BUILD_BUG_ON(IWL_MVM_STATION_COUNT > 32);
  92         WARN_ON_ONCE(test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status));
  93
  94         lockdep_assert_held(&mvm->mutex);
  95
  96         /* d0i3/d3 assumes the AP's sta_id (of sta vif) is 0. reserve it. */
  97         if (iftype != NL80211_IFTYPE_STATION)
  98                 reserved_ids = BIT(0);
  99
 100         /* Don't take rcu_read_lock() since we are protected by mvm->mutex */
 101         for (sta_id = 0; sta_id < IWL_MVM_STATION_COUNT; sta_id++) {
 102                 if (BIT(sta_id) & reserved_ids)
 103                         continue;
 104
 105                 if (!rcu_dereference_protected(mvm->fw_id_to_mac_id[sta_id],
 106                                                lockdep_is_held(&mvm->mutex)))
 107                         return sta_id;
 108         }
 109         return IWL_MVM_STATION_COUNT;
 110 }
 111
 112 /* send station add/update command to firmware */
 113 int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 114                            bool update)
 115 {
 116         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 117         struct iwl_mvm_add_sta_cmd add_sta_cmd = {
 118                 .sta_id = mvm_sta->sta_id,
 119                 .mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color),
 120                 .add_modify = update ? 1 : 0,
 121                 .station_flags_msk = cpu_to_le32(STA_FLG_FAT_EN_MSK |
 122                                                  STA_FLG_MIMO_EN_MSK),
 123                 .tid_disable_tx = cpu_to_le16(mvm_sta->tid_disable_agg),
 124         };
 125         int ret;
 126         u32 status;
 127         u32 agg_size = 0, mpdu_dens = 0;
 128
 129         if (!update) {
 130                 add_sta_cmd.tfd_queue_msk = cpu_to_le32(mvm_sta->tfd_queue_msk);
 131                 memcpy(&add_sta_cmd.addr, sta->addr, ETH_ALEN);
 132         }
 133
 134         switch (sta->bandwidth) {
 135         case IEEE80211_STA_RX_BW_160:
 136                 add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_FAT_EN_160MHZ);
 137                 /* fall through */
 138         case IEEE80211_STA_RX_BW_80:
 139                 add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_FAT_EN_80MHZ);
 140                 /* fall through */
 141         case IEEE80211_STA_RX_BW_40:
 142                 add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_FAT_EN_40MHZ);
 143                 /* fall through */
 144         case IEEE80211_STA_RX_BW_20:
 145                 if (sta->ht_cap.ht_supported)
 146                         add_sta_cmd.station_flags |=
 147                                 cpu_to_le32(STA_FLG_FAT_EN_20MHZ);
 148                 break;
 149         }
 150
 151         switch (sta->rx_nss) {
 152         case 1:
 153                 add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_MIMO_EN_SISO);
 154                 break;
 155         case 2:
 156                 add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_MIMO_EN_MIMO2);
 157                 break;
 158         case 3 ... 8:
 159                 add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_MIMO_EN_MIMO3);
 160                 break;
 161         }
 162
 163         switch (sta->smps_mode) {
 164         case IEEE80211_SMPS_AUTOMATIC:
 165         case IEEE80211_SMPS_NUM_MODES:
 166                 WARN_ON(1);
 167                 break;
 168         case IEEE80211_SMPS_STATIC:
 169                 /* override NSS */
 170                 add_sta_cmd.station_flags &= ~cpu_to_le32(STA_FLG_MIMO_EN_MSK);
 171                 add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_MIMO_EN_SISO);
 172                 break;
 173         case IEEE80211_SMPS_DYNAMIC:
 174                 add_sta_cmd.station_flags |= cpu_to_le32(STA_FLG_RTS_MIMO_PROT);
 175                 break;
 176         case IEEE80211_SMPS_OFF:
 177                 /* nothing */
 178                 break;
 179         }
 180
 181         if (sta->ht_cap.ht_supported) {
 182                 add_sta_cmd.station_flags_msk |=
 183                         cpu_to_le32(STA_FLG_MAX_AGG_SIZE_MSK |
 184                                     STA_FLG_AGG_MPDU_DENS_MSK);
 185
 186                 mpdu_dens = sta->ht_cap.ampdu_density;
 187         }
 188
 189         if (sta->vht_cap.vht_supported) {
 190                 agg_size = sta->vht_cap.cap &
 191                         IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
 192                 agg_size >>=
 193                         IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
 194         } else if (sta->ht_cap.ht_supported) {
 195                 agg_size = sta->ht_cap.ampdu_factor;
 196         }
 197
 198         add_sta_cmd.station_flags |=
 199                 cpu_to_le32(agg_size << STA_FLG_MAX_AGG_SIZE_SHIFT);
 200         add_sta_cmd.station_flags |=
 201                 cpu_to_le32(mpdu_dens << STA_FLG_AGG_MPDU_DENS_SHIFT);
 202
 203         status = ADD_STA_SUCCESS;
 204         ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA,
 205                                           iwl_mvm_add_sta_cmd_size(mvm),
 206                                           &add_sta_cmd, &status);
 207         if (ret)
 208                 return ret;
 209
 210         switch (status & IWL_ADD_STA_STATUS_MASK) {
 211         case ADD_STA_SUCCESS:
 212                 IWL_DEBUG_ASSOC(mvm, "ADD_STA PASSED\n");
 213                 break;
 214         default:
 215                 ret = -EIO;
 216                 IWL_ERR(mvm, "ADD_STA failed\n");
 217                 break;
 218         }
 219
 220         return ret;
 221 }
 222
 223 static int iwl_mvm_tdls_sta_init(struct iwl_mvm *mvm,
 224                                  struct ieee80211_sta *sta)
 225 {
 226         unsigned long used_hw_queues;
 227         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 228         unsigned int wdg_timeout =
 229                 iwl_mvm_get_wd_timeout(mvm, NULL, true, false);
 230         u32 ac;
 231
 232         lockdep_assert_held(&mvm->mutex);
 233
 234         used_hw_queues = iwl_mvm_get_used_hw_queues(mvm, NULL);
 235
 236         /* Find available queues, and allocate them to the ACs */
 237         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 238                 u8 queue = find_first_zero_bit(&used_hw_queues,
 239                                                mvm->first_agg_queue);
 240
 241                 if (queue >= mvm->first_agg_queue) {
 242                         IWL_ERR(mvm, "Failed to allocate STA queue\n");
 243                         return -EBUSY;
 244                 }
 245
 246                 __set_bit(queue, &used_hw_queues);
 247                 mvmsta->hw_queue[ac] = queue;
 248         }
 249
 250         /* Found a place for all queues - enable them */
 251         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 252                 iwl_mvm_enable_ac_txq(mvm, mvmsta->hw_queue[ac],
 253                                       mvmsta->hw_queue[ac],
 254                                       iwl_mvm_ac_to_tx_fifo[ac], 0,
 255                                       wdg_timeout);
 256                 mvmsta->tfd_queue_msk |= BIT(mvmsta->hw_queue[ac]);
 257         }
 258
 259         return 0;
 260 }
 261
 262 static void iwl_mvm_tdls_sta_deinit(struct iwl_mvm *mvm,
 263                                     struct ieee80211_sta *sta)
 264 {
 265         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 266         unsigned long sta_msk;
 267         int i;
 268
 269         lockdep_assert_held(&mvm->mutex);
 270
 271         /* disable the TDLS STA-specific queues */
 272         sta_msk = mvmsta->tfd_queue_msk;
 273         for_each_set_bit(i, &sta_msk, sizeof(sta_msk) * BITS_PER_BYTE)
 274                 iwl_mvm_disable_txq(mvm, i, i, IWL_MAX_TID_COUNT, 0);
 275 }
 276
 277 int iwl_mvm_add_sta(struct iwl_mvm *mvm,
 278                     struct ieee80211_vif *vif,
 279                     struct ieee80211_sta *sta)
 280 {
 281         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 282         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 283         struct iwl_mvm_rxq_dup_data *dup_data;
 284         int i, ret, sta_id;
 285
 286         lockdep_assert_held(&mvm->mutex);
 287
 288         if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
 289                 sta_id = iwl_mvm_find_free_sta_id(mvm,
 290                                                   ieee80211_vif_type_p2p(vif));
 291         else
 292                 sta_id = mvm_sta->sta_id;
 293
 294         if (sta_id == IWL_MVM_STATION_COUNT)
 295                 return -ENOSPC;
 296
 297         spin_lock_init(&mvm_sta->lock);
 298
 299         mvm_sta->sta_id = sta_id;
 300         mvm_sta->mac_id_n_color = FW_CMD_ID_AND_COLOR(mvmvif->id,
 301                                                       mvmvif->color);
 302         mvm_sta->vif = vif;
 303         mvm_sta->max_agg_bufsize = LINK_QUAL_AGG_FRAME_LIMIT_DEF;
 304         mvm_sta->tx_protection = 0;
 305         mvm_sta->tt_tx_protection = false;
 306
 307         /* HW restart, don't assume the memory has been zeroed */
 308         atomic_set(&mvm->pending_frames[sta_id], 0);
 309         mvm_sta->tid_disable_agg = 0xffff; /* No aggs at first */
 310         mvm_sta->tfd_queue_msk = 0;
 311
 312         /* allocate new queues for a TDLS station */
 313         if (sta->tdls) {
 314                 ret = iwl_mvm_tdls_sta_init(mvm, sta);
 315                 if (ret)
 316                         return ret;
 317         } else {
 318                 for (i = 0; i < IEEE80211_NUM_ACS; i++)
 319                         if (vif->hw_queue[i] != IEEE80211_INVAL_HW_QUEUE)
 320                                 mvm_sta->tfd_queue_msk |= BIT(vif->hw_queue[i]);
 321         }
 322
 323         /* for HW restart - reset everything but the sequence number */
 324         for (i = 0; i < IWL_MAX_TID_COUNT; i++) {
 325                 u16 seq = mvm_sta->tid_data[i].seq_number;
 326                 memset(&mvm_sta->tid_data[i], 0, sizeof(mvm_sta->tid_data[i]));
 327                 mvm_sta->tid_data[i].seq_number = seq;
 328         }
 329         mvm_sta->agg_tids = 0;
 330
 331         if (iwl_mvm_has_new_rx_api(mvm) &&
 332             !test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
 333                 dup_data = kcalloc(mvm->trans->num_rx_queues,
 334                                    sizeof(*dup_data),
 335                                    GFP_KERNEL);
 336                 if (!dup_data)
 337                         return -ENOMEM;
 338                 mvm_sta->dup_data = dup_data;
 339         }
 340
 341         ret = iwl_mvm_sta_send_to_fw(mvm, sta, false);
 342         if (ret)
 343                 goto err;
 344
 345         if (vif->type == NL80211_IFTYPE_STATION) {
 346                 if (!sta->tdls) {
 347                         WARN_ON(mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT);
 348                         mvmvif->ap_sta_id = sta_id;
 349                 } else {
 350                         WARN_ON(mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT);
 351                 }
 352         }
 353
 354         rcu_assign_pointer(mvm->fw_id_to_mac_id[sta_id], sta);
 355
 356         return 0;
 357
 358 err:
 359         iwl_mvm_tdls_sta_deinit(mvm, sta);
 360         return ret;
 361 }
 362
 363 int iwl_mvm_update_sta(struct iwl_mvm *mvm,
 364                        struct ieee80211_vif *vif,
 365                        struct ieee80211_sta *sta)
 366 {
 367         return iwl_mvm_sta_send_to_fw(mvm, sta, true);
 368 }
 369
 370 int iwl_mvm_drain_sta(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
 371                       bool drain)
 372 {
 373         struct iwl_mvm_add_sta_cmd cmd = {};
 374         int ret;
 375         u32 status;
 376
 377         lockdep_assert_held(&mvm->mutex);
 378
 379         cmd.mac_id_n_color = cpu_to_le32(mvmsta->mac_id_n_color);
 380         cmd.sta_id = mvmsta->sta_id;
 381         cmd.add_modify = STA_MODE_MODIFY;
 382         cmd.station_flags = drain ? cpu_to_le32(STA_FLG_DRAIN_FLOW) : 0;
 383         cmd.station_flags_msk = cpu_to_le32(STA_FLG_DRAIN_FLOW);
 384
 385         status = ADD_STA_SUCCESS;
 386         ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA,
 387                                           iwl_mvm_add_sta_cmd_size(mvm),
 388                                           &cmd, &status);
 389         if (ret)
 390                 return ret;
 391
 392         switch (status & IWL_ADD_STA_STATUS_MASK) {
 393         case ADD_STA_SUCCESS:
 394                 IWL_DEBUG_INFO(mvm, "Frames for staid %d will drained in fw\n",
 395                                mvmsta->sta_id);
 396                 break;
 397         default:
 398                 ret = -EIO;
 399                 IWL_ERR(mvm, "Couldn't drain frames for staid %d\n",
 400                         mvmsta->sta_id);
 401                 break;
 402         }
 403
 404         return ret;
 405 }
 406
 407 /*
 408  * Remove a station from the FW table. Before sending the command to remove
 409  * the station validate that the station is indeed known to the driver (sanity
 410  * only).
 411  */
 412 static int iwl_mvm_rm_sta_common(struct iwl_mvm *mvm, u8 sta_id)
 413 {
 414         struct ieee80211_sta *sta;
 415         struct iwl_mvm_rm_sta_cmd rm_sta_cmd = {
 416                 .sta_id = sta_id,
 417         };
 418         int ret;
 419
 420         sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[sta_id],
 421                                         lockdep_is_held(&mvm->mutex));
 422
 423         /* Note: internal stations are marked as error values */
 424         if (!sta) {
 425                 IWL_ERR(mvm, "Invalid station id\n");
 426                 return -EINVAL;
 427         }
 428
 429         ret = iwl_mvm_send_cmd_pdu(mvm, REMOVE_STA, 0,
 430                                    sizeof(rm_sta_cmd), &rm_sta_cmd);
 431         if (ret) {
 432                 IWL_ERR(mvm, "Failed to remove station. Id=%d\n", sta_id);
 433                 return ret;
 434         }
 435
 436         return 0;
 437 }
 438
 439 void iwl_mvm_sta_drained_wk(struct work_struct *wk)
 440 {
 441         struct iwl_mvm *mvm = container_of(wk, struct iwl_mvm, sta_drained_wk);
 442         u8 sta_id;
 443
 444         /*
 445          * The mutex is needed because of the SYNC cmd, but not only: if the
 446          * work would run concurrently with iwl_mvm_rm_sta, it would run before
 447          * iwl_mvm_rm_sta sets the station as busy, and exit. Then
 448          * iwl_mvm_rm_sta would set the station as busy, and nobody will clean
 449          * that later.
 450          */
 451         mutex_lock(&mvm->mutex);
 452
 453         for_each_set_bit(sta_id, mvm->sta_drained, IWL_MVM_STATION_COUNT) {
 454                 int ret;
 455                 struct ieee80211_sta *sta =
 456                         rcu_dereference_protected(mvm->fw_id_to_mac_id[sta_id],
 457                                                   lockdep_is_held(&mvm->mutex));
 458
 459                 /*
 460                  * This station is in use or RCU-removed; the latter happens in
 461                  * managed mode, where mac80211 removes the station before we
 462                  * can remove it from firmware (we can only do that after the
 463                  * MAC is marked unassociated), and possibly while the deauth
 464                  * frame to disconnect from the AP is still queued. Then, the
 465                  * station pointer is -ENOENT when the last skb is reclaimed.
 466                  */
 467                 if (!IS_ERR(sta) || PTR_ERR(sta) == -ENOENT)
 468                         continue;
 469
 470                 if (PTR_ERR(sta) == -EINVAL) {
 471                         IWL_ERR(mvm, "Drained sta %d, but it is internal?\n",
 472                                 sta_id);
 473                         continue;
 474                 }
 475
 476                 if (!sta) {
 477                         IWL_ERR(mvm, "Drained sta %d, but it was NULL?\n",
 478                                 sta_id);
 479                         continue;
 480                 }
 481
 482                 WARN_ON(PTR_ERR(sta) != -EBUSY);
 483                 /* This station was removed and we waited until it got drained,
 484                  * we can now proceed and remove it.
 485                  */
 486                 ret = iwl_mvm_rm_sta_common(mvm, sta_id);
 487                 if (ret) {
 488                         IWL_ERR(mvm,
 489                                 "Couldn't remove sta %d after it was drained\n",
 490                                 sta_id);
 491                         continue;
 492                 }
 493                 RCU_INIT_POINTER(mvm->fw_id_to_mac_id[sta_id], NULL);
 494                 clear_bit(sta_id, mvm->sta_drained);
 495
 496                 if (mvm->tfd_drained[sta_id]) {
 497                         unsigned long i, msk = mvm->tfd_drained[sta_id];
 498
 499                         for_each_set_bit(i, &msk, sizeof(msk) * BITS_PER_BYTE)
 500                                 iwl_mvm_disable_txq(mvm, i, i,
 501                                                     IWL_MAX_TID_COUNT, 0);
 502
 503                         mvm->tfd_drained[sta_id] = 0;
 504                         IWL_DEBUG_TDLS(mvm, "Drained sta %d, with queues %ld\n",
 505                                        sta_id, msk);
 506                 }
 507         }
 508
 509         mutex_unlock(&mvm->mutex);
 510 }
 511
 512 int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
 513                    struct ieee80211_vif *vif,
 514                    struct ieee80211_sta *sta)
 515 {
 516         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 517         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 518         int ret;
 519
 520         lockdep_assert_held(&mvm->mutex);
 521
 522         if (iwl_mvm_has_new_rx_api(mvm))
 523                 kfree(mvm_sta->dup_data);
 524
 525         if (vif->type == NL80211_IFTYPE_STATION &&
 526             mvmvif->ap_sta_id == mvm_sta->sta_id) {
 527                 ret = iwl_mvm_drain_sta(mvm, mvm_sta, true);
 528                 if (ret)
 529                         return ret;
 530                 /* flush its queues here since we are freeing mvm_sta */
 531                 ret = iwl_mvm_flush_tx_path(mvm, mvm_sta->tfd_queue_msk, 0);
 532                 if (ret)
 533                         return ret;
 534                 ret = iwl_trans_wait_tx_queue_empty(mvm->trans,
 535                                                     mvm_sta->tfd_queue_msk);
 536                 if (ret)
 537                         return ret;
 538                 ret = iwl_mvm_drain_sta(mvm, mvm_sta, false);
 539
 540                 /* if we are associated - we can't remove the AP STA now */
 541                 if (vif->bss_conf.assoc)
 542                         return ret;
 543
 544                 /* unassoc - go ahead - remove the AP STA now */
 545                 mvmvif->ap_sta_id = IWL_MVM_STATION_COUNT;
 546
 547                 /* clear d0i3_ap_sta_id if no longer relevant */
 548                 if (mvm->d0i3_ap_sta_id == mvm_sta->sta_id)
 549                         mvm->d0i3_ap_sta_id = IWL_MVM_STATION_COUNT;
 550         }
 551
 552         /*
 553          * This shouldn't happen - the TDLS channel switch should be canceled
 554          * before the STA is removed.
 555          */
 556         if (WARN_ON_ONCE(mvm->tdls_cs.peer.sta_id == mvm_sta->sta_id)) {
 557                 mvm->tdls_cs.peer.sta_id = IWL_MVM_STATION_COUNT;
 558                 cancel_delayed_work(&mvm->tdls_cs.dwork);
 559         }
 560
 561         /*
 562          * Make sure that the tx response code sees the station as -EBUSY and
 563          * calls the drain worker.
 564          */
 565         spin_lock_bh(&mvm_sta->lock);
 566         /*
 567          * There are frames pending on the AC queues for this station.
 568          * We need to wait until all the frames are drained...
 569          */
 570         if (atomic_read(&mvm->pending_frames[mvm_sta->sta_id])) {
 571                 rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
 572                                    ERR_PTR(-EBUSY));
 573                 spin_unlock_bh(&mvm_sta->lock);
 574
 575                 /* disable TDLS sta queues on drain complete */
 576                 if (sta->tdls) {
 577                         mvm->tfd_drained[mvm_sta->sta_id] =
 578                                                         mvm_sta->tfd_queue_msk;
 579                         IWL_DEBUG_TDLS(mvm, "Draining TDLS sta %d\n",
 580                                        mvm_sta->sta_id);
 581                 }
 582
 583                 ret = iwl_mvm_drain_sta(mvm, mvm_sta, true);
 584         } else {
 585                 spin_unlock_bh(&mvm_sta->lock);
 586
 587                 if (sta->tdls)
 588                         iwl_mvm_tdls_sta_deinit(mvm, sta);
 589
 590                 ret = iwl_mvm_rm_sta_common(mvm, mvm_sta->sta_id);
 591                 RCU_INIT_POINTER(mvm->fw_id_to_mac_id[mvm_sta->sta_id], NULL);
 592         }
 593
 594         return ret;
 595 }
 596
 597 int iwl_mvm_rm_sta_id(struct iwl_mvm *mvm,
 598                       struct ieee80211_vif *vif,
 599                       u8 sta_id)
 600 {
 601         int ret = iwl_mvm_rm_sta_common(mvm, sta_id);
 602
 603         lockdep_assert_held(&mvm->mutex);
 604
 605         RCU_INIT_POINTER(mvm->fw_id_to_mac_id[sta_id], NULL);
 606         return ret;
 607 }
 608
 609 int iwl_mvm_allocate_int_sta(struct iwl_mvm *mvm,
 610                              struct iwl_mvm_int_sta *sta,
 611                              u32 qmask, enum nl80211_iftype iftype)
 612 {
 613         if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
 614                 sta->sta_id = iwl_mvm_find_free_sta_id(mvm, iftype);
 615                 if (WARN_ON_ONCE(sta->sta_id == IWL_MVM_STATION_COUNT))
 616                         return -ENOSPC;
 617         }
 618
 619         sta->tfd_queue_msk = qmask;
 620
 621         /* put a non-NULL value so iterating over the stations won't stop */
 622         rcu_assign_pointer(mvm->fw_id_to_mac_id[sta->sta_id], ERR_PTR(-EINVAL));
 623         return 0;
 624 }
 625
 626 static void iwl_mvm_dealloc_int_sta(struct iwl_mvm *mvm,
 627                                     struct iwl_mvm_int_sta *sta)
 628 {
 629         RCU_INIT_POINTER(mvm->fw_id_to_mac_id[sta->sta_id], NULL);
 630         memset(sta, 0, sizeof(struct iwl_mvm_int_sta));
 631         sta->sta_id = IWL_MVM_STATION_COUNT;
 632 }
 633
 634 static int iwl_mvm_add_int_sta_common(struct iwl_mvm *mvm,
 635                                       struct iwl_mvm_int_sta *sta,
 636                                       const u8 *addr,
 637                                       u16 mac_id, u16 color)
 638 {
 639         struct iwl_mvm_add_sta_cmd cmd;
 640         int ret;
 641         u32 status;
 642
 643         lockdep_assert_held(&mvm->mutex);
 644
 645         memset(&cmd, 0, sizeof(cmd));
 646         cmd.sta_id = sta->sta_id;
 647         cmd.mac_id_n_color = cpu_to_le32(FW_CMD_ID_AND_COLOR(mac_id,
 648                                                              color));
 649
 650         cmd.tfd_queue_msk = cpu_to_le32(sta->tfd_queue_msk);
 651         cmd.tid_disable_tx = cpu_to_le16(0xffff);
 652
 653         if (addr)
 654                 memcpy(cmd.addr, addr, ETH_ALEN);
 655
 656         ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA,
 657                                           iwl_mvm_add_sta_cmd_size(mvm),
 658                                           &cmd, &status);
 659         if (ret)
 660                 return ret;
 661
 662         switch (status & IWL_ADD_STA_STATUS_MASK) {
 663         case ADD_STA_SUCCESS:
 664                 IWL_DEBUG_INFO(mvm, "Internal station added.\n");
 665                 return 0;
 666         default:
 667                 ret = -EIO;
 668                 IWL_ERR(mvm, "Add internal station failed, status=0x%x\n",
 669                         status);
 670                 break;
 671         }
 672         return ret;
 673 }
 674
 675 int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm)
 676 {
 677         unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
 678                                         mvm->cfg->base_params->wd_timeout :
 679                                         IWL_WATCHDOG_DISABLED;
 680         int ret;
 681
 682         lockdep_assert_held(&mvm->mutex);
 683
 684         /* Map Aux queue to fifo - needs to happen before adding Aux station */
 685         iwl_mvm_enable_ac_txq(mvm, mvm->aux_queue, mvm->aux_queue,
 686                               IWL_MVM_TX_FIFO_MCAST, 0, wdg_timeout);
 687
 688         /* Allocate aux station and assign to it the aux queue */
 689         ret = iwl_mvm_allocate_int_sta(mvm, &mvm->aux_sta, BIT(mvm->aux_queue),
 690                                        NL80211_IFTYPE_UNSPECIFIED);
 691         if (ret)
 692                 return ret;
 693
 694         ret = iwl_mvm_add_int_sta_common(mvm, &mvm->aux_sta, NULL,
 695                                          MAC_INDEX_AUX, 0);
 696
 697         if (ret)
 698                 iwl_mvm_dealloc_int_sta(mvm, &mvm->aux_sta);
 699         return ret;
 700 }
 701
 702 int iwl_mvm_add_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 703 {
 704         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 705
 706         lockdep_assert_held(&mvm->mutex);
 707         return iwl_mvm_add_int_sta_common(mvm, &mvm->snif_sta, vif->addr,
 708                                          mvmvif->id, 0);
 709 }
 710
 711 int iwl_mvm_rm_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 712 {
 713         int ret;
 714
 715         lockdep_assert_held(&mvm->mutex);
 716
 717         ret = iwl_mvm_rm_sta_common(mvm, mvm->snif_sta.sta_id);
 718         if (ret)
 719                 IWL_WARN(mvm, "Failed sending remove station\n");
 720
 721         return ret;
 722 }
 723
 724 void iwl_mvm_dealloc_snif_sta(struct iwl_mvm *mvm)
 725 {
 726         iwl_mvm_dealloc_int_sta(mvm, &mvm->snif_sta);
 727 }
 728
 729 void iwl_mvm_del_aux_sta(struct iwl_mvm *mvm)
 730 {
 731         lockdep_assert_held(&mvm->mutex);
 732
 733         iwl_mvm_dealloc_int_sta(mvm, &mvm->aux_sta);
 734 }
 735
 736 /*
 737  * Send the add station command for the vif's broadcast station.
 738  * Assumes that the station was already allocated.
 739  *
 740  * @mvm: the mvm component
 741  * @vif: the interface to which the broadcast station is added
 742  * @bsta: the broadcast station to add.
 743  */
 744 int iwl_mvm_send_add_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 745 {
 746         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 747         struct iwl_mvm_int_sta *bsta = &mvmvif->bcast_sta;
 748         static const u8 _baddr[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
 749         const u8 *baddr = _baddr;
 750
 751         lockdep_assert_held(&mvm->mutex);
 752
 753         if (vif->type == NL80211_IFTYPE_ADHOC)
 754                 baddr = vif->bss_conf.bssid;
 755
 756         if (WARN_ON_ONCE(bsta->sta_id == IWL_MVM_STATION_COUNT))
 757                 return -ENOSPC;
 758
 759         return iwl_mvm_add_int_sta_common(mvm, bsta, baddr,
 760                                           mvmvif->id, mvmvif->color);
 761 }
 762
 763 /* Send the FW a request to remove the station from it's internal data
 764  * structures, but DO NOT remove the entry from the local data structures. */
 765 int iwl_mvm_send_rm_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 766 {
 767         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 768         int ret;
 769
 770         lockdep_assert_held(&mvm->mutex);
 771
 772         ret = iwl_mvm_rm_sta_common(mvm, mvmvif->bcast_sta.sta_id);
 773         if (ret)
 774                 IWL_WARN(mvm, "Failed sending remove station\n");
 775         return ret;
 776 }
 777
 778 int iwl_mvm_alloc_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 779 {
 780         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 781         u32 qmask;
 782
 783         lockdep_assert_held(&mvm->mutex);
 784
 785         qmask = iwl_mvm_mac_get_queues_mask(vif);
 786
 787         /*
 788          * The firmware defines the TFD queue mask to only be relevant
 789          * for *unicast* queues, so the multicast (CAB) queue shouldn't
 790          * be included.
 791          */
 792         if (vif->type == NL80211_IFTYPE_AP)
 793                 qmask &= ~BIT(vif->cab_queue);
 794
 795         return iwl_mvm_allocate_int_sta(mvm, &mvmvif->bcast_sta, qmask,
 796                                         ieee80211_vif_type_p2p(vif));
 797 }
 798
 799 /* Allocate a new station entry for the broadcast station to the given vif,
 800  * and send it to the FW.
 801  * Note that each P2P mac should have its own broadcast station.
 802  *
 803  * @mvm: the mvm component
 804  * @vif: the interface to which the broadcast station is added
 805  * @bsta: the broadcast station to add. */
 806 int iwl_mvm_add_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 807 {
 808         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 809         struct iwl_mvm_int_sta *bsta = &mvmvif->bcast_sta;
 810         int ret;
 811
 812         lockdep_assert_held(&mvm->mutex);
 813
 814         ret = iwl_mvm_alloc_bcast_sta(mvm, vif);
 815         if (ret)
 816                 return ret;
 817
 818         ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
 819
 820         if (ret)
 821                 iwl_mvm_dealloc_int_sta(mvm, bsta);
 822
 823         return ret;
 824 }
 825
 826 void iwl_mvm_dealloc_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 827 {
 828         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 829
 830         iwl_mvm_dealloc_int_sta(mvm, &mvmvif->bcast_sta);
 831 }
 832
 833 /*
 834  * Send the FW a request to remove the station from it's internal data
 835  * structures, and in addition remove it from the local data structure.
 836  */
 837 int iwl_mvm_rm_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 838 {
 839         int ret;
 840
 841         lockdep_assert_held(&mvm->mutex);
 842
 843         ret = iwl_mvm_send_rm_bcast_sta(mvm, vif);
 844
 845         iwl_mvm_dealloc_bcast_sta(mvm, vif);
 846
 847         return ret;
 848 }
 849
 850 #define IWL_MAX_RX_BA_SESSIONS 16
 851
 852 int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 853                        int tid, u16 ssn, bool start, u8 buf_size)
 854 {
 855         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 856         struct iwl_mvm_add_sta_cmd cmd = {};
 857         int ret;
 858         u32 status;
 859
 860         lockdep_assert_held(&mvm->mutex);
 861
 862         if (start && mvm->rx_ba_sessions >= IWL_MAX_RX_BA_SESSIONS) {
 863                 IWL_WARN(mvm, "Not enough RX BA SESSIONS\n");
 864                 return -ENOSPC;
 865         }
 866
 867         cmd.mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color);
 868         cmd.sta_id = mvm_sta->sta_id;
 869         cmd.add_modify = STA_MODE_MODIFY;
 870         if (start) {
 871                 cmd.add_immediate_ba_tid = (u8) tid;
 872                 cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
 873                 cmd.rx_ba_window = cpu_to_le16((u16)buf_size);
 874         } else {
 875                 cmd.remove_immediate_ba_tid = (u8) tid;
 876         }
 877         cmd.modify_mask = start ? STA_MODIFY_ADD_BA_TID :
 878                                   STA_MODIFY_REMOVE_BA_TID;
 879
 880         status = ADD_STA_SUCCESS;
 881         ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA,
 882                                           iwl_mvm_add_sta_cmd_size(mvm),
 883                                           &cmd, &status);
 884         if (ret)
 885                 return ret;
 886
 887         switch (status & IWL_ADD_STA_STATUS_MASK) {
 888         case ADD_STA_SUCCESS:
 889                 IWL_DEBUG_INFO(mvm, "RX BA Session %sed in fw\n",
 890                                start ? "start" : "stopp");
 891                 break;
 892         case ADD_STA_IMMEDIATE_BA_FAILURE:
 893                 IWL_WARN(mvm, "RX BA Session refused by fw\n");
 894                 ret = -ENOSPC;
 895                 break;
 896         default:
 897                 ret = -EIO;
 898                 IWL_ERR(mvm, "RX BA Session failed %sing, status 0x%x\n",
 899                         start ? "start" : "stopp", status);
 900                 break;
 901         }
 902
 903         if (!ret) {
 904                 if (start)
 905                         mvm->rx_ba_sessions++;
 906                 else if (mvm->rx_ba_sessions > 0)
 907                         /* check that restart flow didn't zero the counter */
 908                         mvm->rx_ba_sessions--;
 909         }
 910
 911         return ret;
 912 }
 913
 914 static int iwl_mvm_sta_tx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 915                               int tid, u8 queue, bool start)
 916 {
 917         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 918         struct iwl_mvm_add_sta_cmd cmd = {};
 919         int ret;
 920         u32 status;
 921
 922         lockdep_assert_held(&mvm->mutex);
 923
 924         if (start) {
 925                 mvm_sta->tfd_queue_msk |= BIT(queue);
 926                 mvm_sta->tid_disable_agg &= ~BIT(tid);
 927         } else {
 928                 mvm_sta->tfd_queue_msk &= ~BIT(queue);
 929                 mvm_sta->tid_disable_agg |= BIT(tid);
 930         }
 931
 932         cmd.mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color);
 933         cmd.sta_id = mvm_sta->sta_id;
 934         cmd.add_modify = STA_MODE_MODIFY;
 935         cmd.modify_mask = STA_MODIFY_QUEUES | STA_MODIFY_TID_DISABLE_TX;
 936         cmd.tfd_queue_msk = cpu_to_le32(mvm_sta->tfd_queue_msk);
 937         cmd.tid_disable_tx = cpu_to_le16(mvm_sta->tid_disable_agg);
 938
 939         status = ADD_STA_SUCCESS;
 940         ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA,
 941                                           iwl_mvm_add_sta_cmd_size(mvm),
 942                                           &cmd, &status);
 943         if (ret)
 944                 return ret;
 945
 946         switch (status & IWL_ADD_STA_STATUS_MASK) {
 947         case ADD_STA_SUCCESS:
 948                 break;
 949         default:
 950                 ret = -EIO;
 951                 IWL_ERR(mvm, "TX BA Session failed %sing, status 0x%x\n",
 952                         start ? "start" : "stopp", status);
 953                 break;
 954         }
 955
 956         return ret;
 957 }
 958
 959 const u8 tid_to_mac80211_ac[] = {
 960         IEEE80211_AC_BE,
 961         IEEE80211_AC_BK,
 962         IEEE80211_AC_BK,
 963         IEEE80211_AC_BE,
 964         IEEE80211_AC_VI,
 965         IEEE80211_AC_VI,
 966         IEEE80211_AC_VO,
 967         IEEE80211_AC_VO,
 968 };
 969
 970 static const u8 tid_to_ucode_ac[] = {
 971         AC_BE,
 972         AC_BK,
 973         AC_BK,
 974         AC_BE,
 975         AC_VI,
 976         AC_VI,
 977         AC_VO,
 978         AC_VO,
 979 };
 980
 981 int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 982                              struct ieee80211_sta *sta, u16 tid, u16 *ssn)
 983 {
 984         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 985         struct iwl_mvm_tid_data *tid_data;
 986         int txq_id;
 987         int ret;
 988
 989         if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
 990                 return -EINVAL;
 991
 992         if (mvmsta->tid_data[tid].state != IWL_AGG_OFF) {
 993                 IWL_ERR(mvm, "Start AGG when state is not IWL_AGG_OFF %d!\n",
 994                         mvmsta->tid_data[tid].state);
 995                 return -ENXIO;
 996         }
 997
 998         lockdep_assert_held(&mvm->mutex);
 999
1000         spin_lock_bh(&mvmsta->lock);
1001
1002         /* possible race condition - we entered D0i3 while starting agg */
1003         if (test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status)) {
1004                 spin_unlock_bh(&mvmsta->lock);
1005                 IWL_ERR(mvm, "Entered D0i3 while starting Tx agg\n");
1006                 return -EIO;
1007         }
1008
1009         spin_lock_bh(&mvm->queue_info_lock);
1010
1011         txq_id = iwl_mvm_find_free_queue(mvm, mvm->first_agg_queue,
1012                                          mvm->last_agg_queue);
1013         if (txq_id < 0) {
1014                 ret = txq_id;
1015                 spin_unlock_bh(&mvm->queue_info_lock);
1016                 IWL_ERR(mvm, "Failed to allocate agg queue\n");
1017                 goto release_locks;
1018         }
1019         mvm->queue_info[txq_id].setup_reserved = true;
1020         spin_unlock_bh(&mvm->queue_info_lock);
1021
1022         tid_data = &mvmsta->tid_data[tid];
1023         tid_data->ssn = IEEE80211_SEQ_TO_SN(tid_data->seq_number);
1024         tid_data->txq_id = txq_id;
1025         *ssn = tid_data->ssn;
1026
1027         IWL_DEBUG_TX_QUEUES(mvm,
1028                             "Start AGG: sta %d tid %d queue %d - ssn = %d, next_recl = %d\n",
1029                             mvmsta->sta_id, tid, txq_id, tid_data->ssn,
1030                             tid_data->next_reclaimed);
1031
1032         if (tid_data->ssn == tid_data->next_reclaimed) {
1033                 tid_data->state = IWL_AGG_STARTING;
1034                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
1035         } else {
1036                 tid_data->state = IWL_EMPTYING_HW_QUEUE_ADDBA;
1037         }
1038
1039         ret = 0;
1040
1041 release_locks:
1042         spin_unlock_bh(&mvmsta->lock);
1043
1044         return ret;
1045 }
1046
1047 int iwl_mvm_sta_tx_agg_oper(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1048                             struct ieee80211_sta *sta, u16 tid, u8 buf_size,
1049                             bool amsdu)
1050 {
1051         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
1052         struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
1053         unsigned int wdg_timeout =
1054                 iwl_mvm_get_wd_timeout(mvm, vif, sta->tdls, false);
1055         int queue, ret;
1056         u16 ssn;
1057
1058         struct iwl_trans_txq_scd_cfg cfg = {
1059                 .sta_id = mvmsta->sta_id,
1060                 .tid = tid,
1061                 .frame_limit = buf_size,
1062                 .aggregate = true,
1063         };
1064
1065         BUILD_BUG_ON((sizeof(mvmsta->agg_tids) * BITS_PER_BYTE)
1066                      != IWL_MAX_TID_COUNT);
1067
1068         buf_size = min_t(int, buf_size, LINK_QUAL_AGG_FRAME_LIMIT_DEF);
1069
1070         spin_lock_bh(&mvmsta->lock);
1071         ssn = tid_data->ssn;
1072         queue = tid_data->txq_id;
1073         tid_data->state = IWL_AGG_ON;
1074         mvmsta->agg_tids |= BIT(tid);
1075         tid_data->ssn = 0xffff;
1076         tid_data->amsdu_in_ampdu_allowed = amsdu;
1077         spin_unlock_bh(&mvmsta->lock);
1078
1079         cfg.fifo = iwl_mvm_ac_to_tx_fifo[tid_to_mac80211_ac[tid]];
1080
1081         iwl_mvm_enable_txq(mvm, queue, vif->hw_queue[tid_to_mac80211_ac[tid]],
1082                            ssn, &cfg, wdg_timeout);
1083
1084         ret = iwl_mvm_sta_tx_agg(mvm, sta, tid, queue, true);
1085         if (ret)
1086                 return -EIO;
1087
1088         /* No need to mark as reserved */
1089         spin_lock_bh(&mvm->queue_info_lock);
1090         mvm->queue_info[queue].setup_reserved = false;
1091         spin_unlock_bh(&mvm->queue_info_lock);
1092
1093         /*
1094          * Even though in theory the peer could have different
1095          * aggregation reorder buffer sizes for different sessions,
1096          * our ucode doesn't allow for that and has a global limit
1097          * for each station. Therefore, use the minimum of all the
1098          * aggregation sessions and our default value.
1099          */
1100         mvmsta->max_agg_bufsize =
1101                 min(mvmsta->max_agg_bufsize, buf_size);
1102         mvmsta->lq_sta.lq.agg_frame_cnt_limit = mvmsta->max_agg_bufsize;
1103
1104         IWL_DEBUG_HT(mvm, "Tx aggregation enabled on ra = %pM tid = %d\n",
1105                      sta->addr, tid);
1106
1107         return iwl_mvm_send_lq_cmd(mvm, &mvmsta->lq_sta.lq, false);
1108 }
1109
1110 int iwl_mvm_sta_tx_agg_stop(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1111                             struct ieee80211_sta *sta, u16 tid)
1112 {
1113         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
1114         struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
1115         u16 txq_id;
1116         int err;
1117
1118
1119         /*
1120          * If mac80211 is cleaning its state, then say that we finished since
1121          * our state has been cleared anyway.
1122          */
1123         if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
1124                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
1125                 return 0;
1126         }
1127
1128         spin_lock_bh(&mvmsta->lock);
1129
1130         txq_id = tid_data->txq_id;
1131
1132         IWL_DEBUG_TX_QUEUES(mvm, "Stop AGG: sta %d tid %d q %d state %d\n",
1133                             mvmsta->sta_id, tid, txq_id, tid_data->state);
1134
1135         mvmsta->agg_tids &= ~BIT(tid);
1136
1137         /* No need to mark as reserved anymore */
1138         spin_lock_bh(&mvm->queue_info_lock);
1139         mvm->queue_info[txq_id].setup_reserved = false;
1140         spin_unlock_bh(&mvm->queue_info_lock);
1141
1142         switch (tid_data->state) {
1143         case IWL_AGG_ON:
1144                 tid_data->ssn = IEEE80211_SEQ_TO_SN(tid_data->seq_number);
1145
1146                 IWL_DEBUG_TX_QUEUES(mvm,
1147                                     "ssn = %d, next_recl = %d\n",
1148                                     tid_data->ssn, tid_data->next_reclaimed);
1149
1150                 /* There are still packets for this RA / TID in the HW */
1151                 if (tid_data->ssn != tid_data->next_reclaimed) {
1152                         tid_data->state = IWL_EMPTYING_HW_QUEUE_DELBA;
1153                         err = 0;
1154                         break;
1155                 }
1156
1157                 tid_data->ssn = 0xffff;
1158                 tid_data->state = IWL_AGG_OFF;
1159                 spin_unlock_bh(&mvmsta->lock);
1160
1161                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
1162
1163                 iwl_mvm_sta_tx_agg(mvm, sta, tid, txq_id, false);
1164
1165                 iwl_mvm_disable_txq(mvm, txq_id,
1166                                     vif->hw_queue[tid_to_mac80211_ac[tid]], tid,
1167                                     0);
1168                 return 0;
1169         case IWL_AGG_STARTING:
1170         case IWL_EMPTYING_HW_QUEUE_ADDBA:
1171                 /*
1172                  * The agg session has been stopped before it was set up. This
1173                  * can happen when the AddBA timer times out for example.
1174                  */
1175
1176                 /* No barriers since we are under mutex */
1177                 lockdep_assert_held(&mvm->mutex);
1178
1179                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
1180                 tid_data->state = IWL_AGG_OFF;
1181                 err = 0;
1182                 break;
1183         default:
1184                 IWL_ERR(mvm,
1185                         "Stopping AGG while state not ON or starting for %d on %d (%d)\n",
1186                         mvmsta->sta_id, tid, tid_data->state);
1187                 IWL_ERR(mvm,
1188                         "\ttid_data->txq_id = %d\n", tid_data->txq_id);
1189                 err = -EINVAL;
1190         }
1191
1192         spin_unlock_bh(&mvmsta->lock);
1193
1194         return err;
1195 }
1196
1197 int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
1198                             struct ieee80211_sta *sta, u16 tid)
1199 {
1200         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
1201         struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
1202         u16 txq_id;
1203         enum iwl_mvm_agg_state old_state;
1204
1205         /*
1206          * First set the agg state to OFF to avoid calling
1207          * ieee80211_stop_tx_ba_cb in iwl_mvm_check_ratid_empty.
1208          */
1209         spin_lock_bh(&mvmsta->lock);
1210         txq_id = tid_data->txq_id;
1211         IWL_DEBUG_TX_QUEUES(mvm, "Flush AGG: sta %d tid %d q %d state %d\n",
1212                             mvmsta->sta_id, tid, txq_id, tid_data->state);
1213         old_state = tid_data->state;
1214         tid_data->state = IWL_AGG_OFF;
1215         mvmsta->agg_tids &= ~BIT(tid);
1216         spin_unlock_bh(&mvmsta->lock);
1217
1218         /* No need to mark as reserved */
1219         spin_lock_bh(&mvm->queue_info_lock);
1220         mvm->queue_info[txq_id].setup_reserved = false;
1221         spin_unlock_bh(&mvm->queue_info_lock);
1222
1223         if (old_state >= IWL_AGG_ON) {
1224                 iwl_mvm_drain_sta(mvm, mvmsta, true);
1225                 if (iwl_mvm_flush_tx_path(mvm, BIT(txq_id), 0))
1226                         IWL_ERR(mvm, "Couldn't flush the AGG queue\n");
1227                 iwl_trans_wait_tx_queue_empty(mvm->trans,
1228                                               mvmsta->tfd_queue_msk);
1229                 iwl_mvm_drain_sta(mvm, mvmsta, false);
1230
1231                 iwl_mvm_sta_tx_agg(mvm, sta, tid, txq_id, false);
1232
1233                 iwl_mvm_disable_txq(mvm, tid_data->txq_id,
1234                                     vif->hw_queue[tid_to_mac80211_ac[tid]], tid,
1235                                     0);
1236         }
1237
1238         return 0;
1239 }
1240
1241 static int iwl_mvm_set_fw_key_idx(struct iwl_mvm *mvm)
1242 {
1243         int i, max = -1, max_offs = -1;
1244
1245         lockdep_assert_held(&mvm->mutex);
1246
1247         /* Pick the unused key offset with the highest 'deleted'
1248          * counter. Every time a key is deleted, all the counters
1249          * are incremented and the one that was just deleted is
1250          * reset to zero. Thus, the highest counter is the one
1251          * that was deleted longest ago. Pick that one.
1252          */
1253         for (i = 0; i < STA_KEY_MAX_NUM; i++) {
1254                 if (test_bit(i, mvm->fw_key_table))
1255                         continue;
1256                 if (mvm->fw_key_deleted[i] > max) {
1257                         max = mvm->fw_key_deleted[i];
1258                         max_offs = i;
1259                 }
1260         }
1261
1262         if (max_offs < 0)
1263                 return STA_KEY_IDX_INVALID;
1264
1265         return max_offs;
1266 }
1267
1268 static struct iwl_mvm_sta *iwl_mvm_get_key_sta(struct iwl_mvm *mvm,
1269                                                struct ieee80211_vif *vif,
1270                                                struct ieee80211_sta *sta)
1271 {
1272         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1273
1274         if (sta)
1275                 return iwl_mvm_sta_from_mac80211(sta);
1276
1277         /*
1278          * The device expects GTKs for station interfaces to be
1279          * installed as GTKs for the AP station. If we have no
1280          * station ID, then use AP's station ID.
1281          */
1282         if (vif->type == NL80211_IFTYPE_STATION &&
1283             mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT) {
1284                 u8 sta_id = mvmvif->ap_sta_id;
1285
1286                 sta = rcu_dereference_check(mvm->fw_id_to_mac_id[sta_id],
1287                                             lockdep_is_held(&mvm->mutex));
1288                 /*
1289                  * It is possible that the 'sta' parameter is NULL,
1290                  * for example when a GTK is removed - the sta_id will then
1291                  * be the AP ID, and no station was passed by mac80211.
1292                  */
1293                 if (IS_ERR_OR_NULL(sta))
1294                         return NULL;
1295
1296                 return iwl_mvm_sta_from_mac80211(sta);
1297         }
1298
1299         return NULL;
1300 }
1301
1302 static int iwl_mvm_send_sta_key(struct iwl_mvm *mvm,
1303                                 struct iwl_mvm_sta *mvm_sta,
1304                                 struct ieee80211_key_conf *keyconf, bool mcast,
1305                                 u32 tkip_iv32, u16 *tkip_p1k, u32 cmd_flags,
1306                                 u8 key_offset)
1307 {
1308         struct iwl_mvm_add_sta_key_cmd cmd = {};
1309         __le16 key_flags;
1310         int ret;
1311         u32 status;
1312         u16 keyidx;
1313         int i;
1314         u8 sta_id = mvm_sta->sta_id;
1315
1316         keyidx = (keyconf->keyidx << STA_KEY_FLG_KEYID_POS) &
1317                  STA_KEY_FLG_KEYID_MSK;
1318         key_flags = cpu_to_le16(keyidx);
1319         key_flags |= cpu_to_le16(STA_KEY_FLG_WEP_KEY_MAP);
1320
1321         switch (keyconf->cipher) {
1322         case WLAN_CIPHER_SUITE_TKIP:
1323                 key_flags |= cpu_to_le16(STA_KEY_FLG_TKIP);
1324                 cmd.tkip_rx_tsc_byte2 = tkip_iv32;
1325                 for (i = 0; i < 5; i++)
1326                         cmd.tkip_rx_ttak[i] = cpu_to_le16(tkip_p1k[i]);
1327                 memcpy(cmd.key, keyconf->key, keyconf->keylen);
1328                 break;
1329         case WLAN_CIPHER_SUITE_CCMP:
1330                 key_flags |= cpu_to_le16(STA_KEY_FLG_CCM);
1331                 memcpy(cmd.key, keyconf->key, keyconf->keylen);
1332                 break;
1333         case WLAN_CIPHER_SUITE_WEP104:
1334                 key_flags |= cpu_to_le16(STA_KEY_FLG_WEP_13BYTES);
1335                 /* fall through */
1336         case WLAN_CIPHER_SUITE_WEP40:
1337                 key_flags |= cpu_to_le16(STA_KEY_FLG_WEP);
1338                 memcpy(cmd.key + 3, keyconf->key, keyconf->keylen);
1339                 break;
1340         default:
1341                 key_flags |= cpu_to_le16(STA_KEY_FLG_EXT);
1342                 memcpy(cmd.key, keyconf->key, keyconf->keylen);
1343         }
1344
1345         if (mcast)
1346                 key_flags |= cpu_to_le16(STA_KEY_MULTICAST);
1347
1348         cmd.key_offset = key_offset;
1349         cmd.key_flags = key_flags;
1350         cmd.sta_id = sta_id;
1351
1352         status = ADD_STA_SUCCESS;
1353         if (cmd_flags & CMD_ASYNC)
1354                 ret =  iwl_mvm_send_cmd_pdu(mvm, ADD_STA_KEY, CMD_ASYNC,
1355                                             sizeof(cmd), &cmd);
1356         else
1357                 ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA_KEY, sizeof(cmd),
1358                                                   &cmd, &status);
1359
1360         switch (status) {
1361         case ADD_STA_SUCCESS:
1362                 IWL_DEBUG_WEP(mvm, "MODIFY_STA: set dynamic key passed\n");
1363                 break;
1364         default:
1365                 ret = -EIO;
1366                 IWL_ERR(mvm, "MODIFY_STA: set dynamic key failed\n");
1367                 break;
1368         }
1369
1370         return ret;
1371 }
1372
1373 static int iwl_mvm_send_sta_igtk(struct iwl_mvm *mvm,
1374                                  struct ieee80211_key_conf *keyconf,
1375                                  u8 sta_id, bool remove_key)
1376 {
1377         struct iwl_mvm_mgmt_mcast_key_cmd igtk_cmd = {};
1378
1379         /* verify the key details match the required command's expectations */
1380         if (WARN_ON((keyconf->cipher != WLAN_CIPHER_SUITE_AES_CMAC) ||
1381                     (keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
1382                     (keyconf->keyidx != 4 && keyconf->keyidx != 5)))
1383                 return -EINVAL;
1384
1385         igtk_cmd.key_id = cpu_to_le32(keyconf->keyidx);
1386         igtk_cmd.sta_id = cpu_to_le32(sta_id);
1387
1388         if (remove_key) {
1389                 igtk_cmd.ctrl_flags |= cpu_to_le32(STA_KEY_NOT_VALID);
1390         } else {
1391                 struct ieee80211_key_seq seq;
1392                 const u8 *pn;
1393
1394                 memcpy(igtk_cmd.IGTK, keyconf->key, keyconf->keylen);
1395                 ieee80211_get_key_rx_seq(keyconf, 0, &seq);
1396                 pn = seq.aes_cmac.pn;
1397                 igtk_cmd.receive_seq_cnt = cpu_to_le64(((u64) pn[5] << 0) |
1398                                                        ((u64) pn[4] << 8) |
1399                                                        ((u64) pn[3] << 16) |
1400                                                        ((u64) pn[2] << 24) |
1401                                                        ((u64) pn[1] << 32) |
1402                                                        ((u64) pn[0] << 40));
1403         }
1404
1405         IWL_DEBUG_INFO(mvm, "%s igtk for sta %u\n",
1406                        remove_key ? "removing" : "installing",
1407                        igtk_cmd.sta_id);
1408
1409         return iwl_mvm_send_cmd_pdu(mvm, MGMT_MCAST_KEY, 0,
1410                                     sizeof(igtk_cmd), &igtk_cmd);
1411 }
1412
1413
1414 static inline u8 *iwl_mvm_get_mac_addr(struct iwl_mvm *mvm,
1415                                        struct ieee80211_vif *vif,
1416                                        struct ieee80211_sta *sta)
1417 {
1418         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1419
1420         if (sta)
1421                 return sta->addr;
1422
1423         if (vif->type == NL80211_IFTYPE_STATION &&
1424             mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT) {
1425                 u8 sta_id = mvmvif->ap_sta_id;
1426                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[sta_id],
1427                                                 lockdep_is_held(&mvm->mutex));
1428                 return sta->addr;
1429         }
1430
1431
1432         return NULL;
1433 }
1434
1435 static int __iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
1436                                  struct ieee80211_vif *vif,
1437                                  struct ieee80211_sta *sta,
1438                                  struct ieee80211_key_conf *keyconf,
1439                                  u8 key_offset,
1440                                  bool mcast)
1441 {
1442         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
1443         int ret;
1444         const u8 *addr;
1445         struct ieee80211_key_seq seq;
1446         u16 p1k[5];
1447
1448         switch (keyconf->cipher) {
1449         case WLAN_CIPHER_SUITE_TKIP:
1450                 addr = iwl_mvm_get_mac_addr(mvm, vif, sta);
1451                 /* get phase 1 key from mac80211 */
1452                 ieee80211_get_key_rx_seq(keyconf, 0, &seq);
1453                 ieee80211_get_tkip_rx_p1k(keyconf, addr, seq.tkip.iv32, p1k);
1454                 ret = iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, mcast,
1455                                            seq.tkip.iv32, p1k, 0, key_offset);
1456                 break;
1457         case WLAN_CIPHER_SUITE_CCMP:
1458         case WLAN_CIPHER_SUITE_WEP40:
1459         case WLAN_CIPHER_SUITE_WEP104:
1460                 ret = iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, mcast,
1461                                            0, NULL, 0, key_offset);
1462                 break;
1463         default:
1464                 ret = iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, mcast,
1465                                            0, NULL, 0, key_offset);
1466         }
1467
1468         return ret;
1469 }
1470
1471 static int __iwl_mvm_remove_sta_key(struct iwl_mvm *mvm, u8 sta_id,
1472                                     struct ieee80211_key_conf *keyconf,
1473                                     bool mcast)
1474 {
1475         struct iwl_mvm_add_sta_key_cmd cmd = {};
1476         __le16 key_flags;
1477         int ret;
1478         u32 status;
1479
1480         key_flags = cpu_to_le16((keyconf->keyidx << STA_KEY_FLG_KEYID_POS) &
1481                                  STA_KEY_FLG_KEYID_MSK);
1482         key_flags |= cpu_to_le16(STA_KEY_FLG_NO_ENC | STA_KEY_FLG_WEP_KEY_MAP);
1483         key_flags |= cpu_to_le16(STA_KEY_NOT_VALID);
1484
1485         if (mcast)
1486                 key_flags |= cpu_to_le16(STA_KEY_MULTICAST);
1487
1488         cmd.key_flags = key_flags;
1489         cmd.key_offset = keyconf->hw_key_idx;
1490         cmd.sta_id = sta_id;
1491
1492         status = ADD_STA_SUCCESS;
1493         ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA_KEY, sizeof(cmd),
1494                                           &cmd, &status);
1495
1496         switch (status) {
1497         case ADD_STA_SUCCESS:
1498                 IWL_DEBUG_WEP(mvm, "MODIFY_STA: remove sta key passed\n");
1499                 break;
1500         default:
1501                 ret = -EIO;
1502                 IWL_ERR(mvm, "MODIFY_STA: remove sta key failed\n");
1503                 break;
1504         }
1505
1506         return ret;
1507 }
1508
1509 int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
1510                         struct ieee80211_vif *vif,
1511                         struct ieee80211_sta *sta,
1512                         struct ieee80211_key_conf *keyconf,
1513                         u8 key_offset)
1514 {
1515         bool mcast = !(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE);
1516         struct iwl_mvm_sta *mvm_sta;
1517         u8 sta_id;
1518         int ret;
1519         static const u8 __maybe_unused zero_addr[ETH_ALEN] = {0};
1520
1521         lockdep_assert_held(&mvm->mutex);
1522
1523         /* Get the station id from the mvm local station table */
1524         mvm_sta = iwl_mvm_get_key_sta(mvm, vif, sta);
1525         if (!mvm_sta) {
1526                 IWL_ERR(mvm, "Failed to find station\n");
1527                 return -EINVAL;
1528         }
1529         sta_id = mvm_sta->sta_id;
1530
1531         if (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC) {
1532                 ret = iwl_mvm_send_sta_igtk(mvm, keyconf, sta_id, false);
1533                 goto end;
1534         }
1535
1536         /*
1537          * It is possible that the 'sta' parameter is NULL, and thus
1538          * there is a need to retrieve  the sta from the local station table.
1539          */
1540         if (!sta) {
1541                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[sta_id],
1542                                                 lockdep_is_held(&mvm->mutex));
1543                 if (IS_ERR_OR_NULL(sta)) {
1544                         IWL_ERR(mvm, "Invalid station id\n");
1545                         return -EINVAL;
1546                 }
1547         }
1548
1549         if (WARN_ON_ONCE(iwl_mvm_sta_from_mac80211(sta)->vif != vif))
1550                 return -EINVAL;
1551
1552         /* If the key_offset is not pre-assigned, we need to find a
1553          * new offset to use.  In normal cases, the offset is not
1554          * pre-assigned, but during HW_RESTART we want to reuse the
1555          * same indices, so we pass them when this function is called.
1556          *
1557          * In D3 entry, we need to hardcoded the indices (because the
1558          * firmware hardcodes the PTK offset to 0).  In this case, we
1559          * need to make sure we don't overwrite the hw_key_idx in the
1560          * keyconf structure, because otherwise we cannot configure
1561          * the original ones back when resuming.
1562          */
1563         if (key_offset == STA_KEY_IDX_INVALID) {
1564                 key_offset  = iwl_mvm_set_fw_key_idx(mvm);
1565                 if (key_offset == STA_KEY_IDX_INVALID)
1566                         return -ENOSPC;
1567                 keyconf->hw_key_idx = key_offset;
1568         }
1569
1570         ret = __iwl_mvm_set_sta_key(mvm, vif, sta, keyconf, key_offset, mcast);
1571         if (ret)
1572                 goto end;
1573
1574         /*
1575          * For WEP, the same key is used for multicast and unicast. Upload it
1576          * again, using the same key offset, and now pointing the other one
1577          * to the same key slot (offset).
1578          * If this fails, remove the original as well.
1579          */
1580         if (keyconf->cipher == WLAN_CIPHER_SUITE_WEP40 ||
1581             keyconf->cipher == WLAN_CIPHER_SUITE_WEP104) {
1582                 ret = __iwl_mvm_set_sta_key(mvm, vif, sta, keyconf,
1583                                             key_offset, !mcast);
1584                 if (ret) {
1585                         __iwl_mvm_remove_sta_key(mvm, sta_id, keyconf, mcast);
1586                         goto end;
1587                 }
1588         }
1589
1590         __set_bit(key_offset, mvm->fw_key_table);
1591
1592 end:
1593         IWL_DEBUG_WEP(mvm, "key: cipher=%x len=%d idx=%d sta=%pM ret=%d\n",
1594                       keyconf->cipher, keyconf->keylen, keyconf->keyidx,
1595                       sta ? sta->addr : zero_addr, ret);
1596         return ret;
1597 }
1598
1599 int iwl_mvm_remove_sta_key(struct iwl_mvm *mvm,
1600                            struct ieee80211_vif *vif,
1601                            struct ieee80211_sta *sta,
1602                            struct ieee80211_key_conf *keyconf)
1603 {
1604         bool mcast = !(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE);
1605         struct iwl_mvm_sta *mvm_sta;
1606         u8 sta_id = IWL_MVM_STATION_COUNT;
1607         int ret, i;
1608
1609         lockdep_assert_held(&mvm->mutex);
1610
1611         /* Get the station from the mvm local station table */
1612         mvm_sta = iwl_mvm_get_key_sta(mvm, vif, sta);
1613
1614         IWL_DEBUG_WEP(mvm, "mvm remove dynamic key: idx=%d sta=%d\n",
1615                       keyconf->keyidx, sta_id);
1616
1617         if (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC)
1618                 return iwl_mvm_send_sta_igtk(mvm, keyconf, sta_id, true);
1619
1620         if (!__test_and_clear_bit(keyconf->hw_key_idx, mvm->fw_key_table)) {
1621                 IWL_ERR(mvm, "offset %d not used in fw key table.\n",
1622                         keyconf->hw_key_idx);
1623                 return -ENOENT;
1624         }
1625
1626         /* track which key was deleted last */
1627         for (i = 0; i < STA_KEY_MAX_NUM; i++) {
1628                 if (mvm->fw_key_deleted[i] < U8_MAX)
1629                         mvm->fw_key_deleted[i]++;
1630         }
1631         mvm->fw_key_deleted[keyconf->hw_key_idx] = 0;
1632
1633         if (!mvm_sta) {
1634                 IWL_DEBUG_WEP(mvm, "station non-existent, early return.\n");
1635                 return 0;
1636         }
1637
1638         sta_id = mvm_sta->sta_id;
1639
1640         ret = __iwl_mvm_remove_sta_key(mvm, sta_id, keyconf, mcast);
1641         if (ret)
1642                 return ret;
1643
1644         /* delete WEP key twice to get rid of (now useless) offset */
1645         if (keyconf->cipher == WLAN_CIPHER_SUITE_WEP40 ||
1646             keyconf->cipher == WLAN_CIPHER_SUITE_WEP104)
1647                 ret = __iwl_mvm_remove_sta_key(mvm, sta_id, keyconf, !mcast);
1648
1649         return ret;
1650 }
1651
1652 void iwl_mvm_update_tkip_key(struct iwl_mvm *mvm,
1653                              struct ieee80211_vif *vif,
1654                              struct ieee80211_key_conf *keyconf,
1655                              struct ieee80211_sta *sta, u32 iv32,
1656                              u16 *phase1key)
1657 {
1658         struct iwl_mvm_sta *mvm_sta;
1659         bool mcast = !(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE);
1660
1661         rcu_read_lock();
1662
1663         mvm_sta = iwl_mvm_get_key_sta(mvm, vif, sta);
1664         if (WARN_ON_ONCE(!mvm_sta))
1665                 goto unlock;
1666         iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, mcast,
1667                              iv32, phase1key, CMD_ASYNC, keyconf->hw_key_idx);
1668
1669  unlock:
1670         rcu_read_unlock();
1671 }
1672
1673 void iwl_mvm_sta_modify_ps_wake(struct iwl_mvm *mvm,
1674                                 struct ieee80211_sta *sta)
1675 {
1676         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
1677         struct iwl_mvm_add_sta_cmd cmd = {
1678                 .add_modify = STA_MODE_MODIFY,
1679                 .sta_id = mvmsta->sta_id,
1680                 .station_flags_msk = cpu_to_le32(STA_FLG_PS),
1681                 .mac_id_n_color = cpu_to_le32(mvmsta->mac_id_n_color),
1682         };
1683         int ret;
1684
1685         ret = iwl_mvm_send_cmd_pdu(mvm, ADD_STA, CMD_ASYNC,
1686                                    iwl_mvm_add_sta_cmd_size(mvm), &cmd);
1687         if (ret)
1688                 IWL_ERR(mvm, "Failed to send ADD_STA command (%d)\n", ret);
1689 }
1690
1691 void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
1692                                        struct ieee80211_sta *sta,
1693                                        enum ieee80211_frame_release_type reason,
1694                                        u16 cnt, u16 tids, bool more_data,
1695                                        bool agg)
1696 {
1697         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
1698         struct iwl_mvm_add_sta_cmd cmd = {
1699                 .add_modify = STA_MODE_MODIFY,
1700                 .sta_id = mvmsta->sta_id,
1701                 .modify_mask = STA_MODIFY_SLEEPING_STA_TX_COUNT,
1702                 .sleep_tx_count = cpu_to_le16(cnt),
1703                 .mac_id_n_color = cpu_to_le32(mvmsta->mac_id_n_color),
1704         };
1705         int tid, ret;
1706         unsigned long _tids = tids;
1707
1708         /* convert TIDs to ACs - we don't support TSPEC so that's OK
1709          * Note that this field is reserved and unused by firmware not
1710          * supporting GO uAPSD, so it's safe to always do this.
1711          */
1712         for_each_set_bit(tid, &_tids, IWL_MAX_TID_COUNT)
1713                 cmd.awake_acs |= BIT(tid_to_ucode_ac[tid]);
1714
1715         /* If we're releasing frames from aggregation queues then check if the
1716          * all queues combined that we're releasing frames from have
1717          *  - more frames than the service period, in which case more_data
1718          *    needs to be set
1719          *  - fewer than 'cnt' frames, in which case we need to adjust the
1720          *    firmware command (but do that unconditionally)
1721          */
1722         if (agg) {
1723                 int remaining = cnt;
1724                 int sleep_tx_count;
1725
1726                 spin_lock_bh(&mvmsta->lock);
1727                 for_each_set_bit(tid, &_tids, IWL_MAX_TID_COUNT) {
1728                         struct iwl_mvm_tid_data *tid_data;
1729                         u16 n_queued;
1730
1731                         tid_data = &mvmsta->tid_data[tid];
1732                         if (WARN(tid_data->state != IWL_AGG_ON &&
1733                                  tid_data->state != IWL_EMPTYING_HW_QUEUE_DELBA,
1734                                  "TID %d state is %d\n",
1735                                  tid, tid_data->state)) {
1736                                 spin_unlock_bh(&mvmsta->lock);
1737                                 ieee80211_sta_eosp(sta);
1738                                 return;
1739                         }
1740
1741                         n_queued = iwl_mvm_tid_queued(tid_data);
1742                         if (n_queued > remaining) {
1743                                 more_data = true;
1744                                 remaining = 0;
1745                                 break;
1746                         }
1747                         remaining -= n_queued;
1748                 }
1749                 sleep_tx_count = cnt - remaining;
1750                 if (reason == IEEE80211_FRAME_RELEASE_UAPSD)
1751                         mvmsta->sleep_tx_count = sleep_tx_count;
1752                 spin_unlock_bh(&mvmsta->lock);
1753
1754                 cmd.sleep_tx_count = cpu_to_le16(sleep_tx_count);
1755                 if (WARN_ON(cnt - remaining == 0)) {
1756                         ieee80211_sta_eosp(sta);
1757                         return;
1758                 }
1759         }
1760
1761         /* Note: this is ignored by firmware not supporting GO uAPSD */
1762         if (more_data)
1763                 cmd.sleep_state_flags |= cpu_to_le16(STA_SLEEP_STATE_MOREDATA);
1764
1765         if (reason == IEEE80211_FRAME_RELEASE_PSPOLL) {
1766                 mvmsta->next_status_eosp = true;
1767                 cmd.sleep_state_flags |= cpu_to_le16(STA_SLEEP_STATE_PS_POLL);
1768         } else {
1769                 cmd.sleep_state_flags |= cpu_to_le16(STA_SLEEP_STATE_UAPSD);
1770         }
1771
1772         /* block the Tx queues until the FW updated the sleep Tx count */
1773         iwl_trans_block_txq_ptrs(mvm->trans, true);
1774
1775         ret = iwl_mvm_send_cmd_pdu(mvm, ADD_STA,
1776                                    CMD_ASYNC | CMD_WANT_ASYNC_CALLBACK,
1777                                    iwl_mvm_add_sta_cmd_size(mvm), &cmd);
1778         if (ret)
1779                 IWL_ERR(mvm, "Failed to send ADD_STA command (%d)\n", ret);
1780 }
1781
1782 void iwl_mvm_rx_eosp_notif(struct iwl_mvm *mvm,
1783                            struct iwl_rx_cmd_buffer *rxb)
1784 {
1785         struct iwl_rx_packet *pkt = rxb_addr(rxb);
1786         struct iwl_mvm_eosp_notification *notif = (void *)pkt->data;
1787         struct ieee80211_sta *sta;
1788         u32 sta_id = le32_to_cpu(notif->sta_id);
1789
1790         if (WARN_ON_ONCE(sta_id >= IWL_MVM_STATION_COUNT))
1791                 return;
1792
1793         rcu_read_lock();
1794         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
1795         if (!IS_ERR_OR_NULL(sta))
1796                 ieee80211_sta_eosp(sta);
1797         rcu_read_unlock();
1798 }
1799
1800 void iwl_mvm_sta_modify_disable_tx(struct iwl_mvm *mvm,
1801                                    struct iwl_mvm_sta *mvmsta, bool disable)
1802 {
1803         struct iwl_mvm_add_sta_cmd cmd = {
1804                 .add_modify = STA_MODE_MODIFY,
1805                 .sta_id = mvmsta->sta_id,
1806                 .station_flags = disable ? cpu_to_le32(STA_FLG_DISABLE_TX) : 0,
1807                 .station_flags_msk = cpu_to_le32(STA_FLG_DISABLE_TX),
1808                 .mac_id_n_color = cpu_to_le32(mvmsta->mac_id_n_color),
1809         };
1810         int ret;
1811
1812         ret = iwl_mvm_send_cmd_pdu(mvm, ADD_STA, CMD_ASYNC,
1813                                    iwl_mvm_add_sta_cmd_size(mvm), &cmd);
1814         if (ret)
1815                 IWL_ERR(mvm, "Failed to send ADD_STA command (%d)\n", ret);
1816 }
1817
1818 void iwl_mvm_sta_modify_disable_tx_ap(struct iwl_mvm *mvm,
1819                                       struct ieee80211_sta *sta,
1820                                       bool disable)
1821 {
1822         struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
1823
1824         spin_lock_bh(&mvm_sta->lock);
1825
1826         if (mvm_sta->disable_tx == disable) {
1827                 spin_unlock_bh(&mvm_sta->lock);
1828                 return;
1829         }
1830
1831         mvm_sta->disable_tx = disable;
1832
1833         /*
1834          * Tell mac80211 to start/stop queuing tx for this station,
1835          * but don't stop queuing if there are still pending frames
1836          * for this station.
1837          */
1838         if (disable || !atomic_read(&mvm->pending_frames[mvm_sta->sta_id]))
1839                 ieee80211_sta_block_awake(mvm->hw, sta, disable);
1840
1841         iwl_mvm_sta_modify_disable_tx(mvm, mvm_sta, disable);
1842
1843         spin_unlock_bh(&mvm_sta->lock);
1844 }
1845
1846 void iwl_mvm_modify_all_sta_disable_tx(struct iwl_mvm *mvm,
1847                                        struct iwl_mvm_vif *mvmvif,
1848                                        bool disable)
1849 {
1850         struct ieee80211_sta *sta;
1851         struct iwl_mvm_sta *mvm_sta;
1852         int i;
1853
1854         lockdep_assert_held(&mvm->mutex);
1855
1856         /* Block/unblock all the stations of the given mvmvif */
1857         for (i = 0; i < IWL_MVM_STATION_COUNT; i++) {
1858                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
1859                                                 lockdep_is_held(&mvm->mutex));
1860                 if (IS_ERR_OR_NULL(sta))
1861                         continue;
1862
1863                 mvm_sta = iwl_mvm_sta_from_mac80211(sta);
1864                 if (mvm_sta->mac_id_n_color !=
1865                     FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color))
1866                         continue;
1867
1868                 iwl_mvm_sta_modify_disable_tx_ap(mvm, sta, disable);
1869         }
1870 }
1871
1872 void iwl_mvm_csa_client_absent(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
1873 {
1874         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
1875         struct iwl_mvm_sta *mvmsta;
1876
1877         rcu_read_lock();
1878
1879         mvmsta = iwl_mvm_sta_from_staid_rcu(mvm, mvmvif->ap_sta_id);
1880
1881         if (!WARN_ON(!mvmsta))
1882                 iwl_mvm_sta_modify_disable_tx(mvm, mvmsta, true);
1883
1884         rcu_read_unlock();
1885 }