This removes the use of the two deprecated calls to the
macro PTR_RET in iwl_mvm_get_regdomain and replaces them
both to PTR_ERR_OR_ZERO.
Signed-off-by: Nicholas Krause <xerofoify@gmail.com>
[Commit message editing]
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit b112889c ("iwlwifi: mvm: add Aux ROC request/response flow")
added aux ROC flow in addition to the existing ROC flow. While doing
it, it moved the ROC reference release to a common work item, which
is being called for both the ROC and aux ROC flows.

This resulted in invalid reference accounting, as no reference was
taken in case of aux ROC, while a reference was released on completion.

Fix it by adding a reference for the aux ROC as well, and release
only the relevant references on completion (according to the set bits).

While at it, convert cancel_work_sync() to flush_work(), in order
to make sure the references are being cleaned properly.

Fixes: b112889c ("iwlwifi: mvm: add Aux ROC request/response flow")
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

A few triggers have status = MLME_SUCCESS and they are still
interesting. E.g. if we want to collect data upon deauth,
the status will be MLME_SUCCESS. Fix that.

Fixes: d42f5350 ("iwlwifi: mvm: add trigger for firmware dump upon MLME failures")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

When a firmware restart is done, don't try to reprogram the keys to new
slots but rather just keep the old key index, while skipping keys that
weren't programmed before.

Not only does this restore the state more faithfully, but it will also
allow using the HW key index for internal purposes as an array index.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Usually during HW recovery the state of all active interfaces is cleaned
up during drv_start(). There's a special case where a HW restart is
requested when an interface is going down. In this case the iface-iterator
won't see this interface and we won't clean it. This has bad consequences
once the interface is legitimately brought up again.
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Instead of repeating the same code in 4 different places, combine the
comparisons into a new function.  Additionally, this change fixes UMAC
scans where the RRM IEs were not taken into consideration when
calculating the IE length.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

We don't support -9.ucode so, all the released firmwares
support scheduled scan properly.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Net-detect scans were using the same type as sched scan, which was
causing the driver to return -EBUSY and prevent the system from
suspending if there was an ongoing scheduled scan.  To avoid this, add
a new type for net-detect and don't stop anything when it is
requested, so that the existing scheduled scan will be resumed when
the system wakes up.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Move all the scan code that was in mac80211.c to scan.c where it
belongs, leaving only the parts that are specific to mac80211 ops.

Change some function definitions slightly to improve consistency.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

All scans are using the unified APIs now, so using "unified" in the
symbols is useless and just make them much longer and the main
difference between scans now is LMAC vs. UMAC.  Remove "unified" from
all relevant symbols.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Instead of hardcoding the differences between UMAC scans and LMAC
scans (which in this case is the number of simultaneous scans that can
run), introduce a max_scans variable and stop scans of the other type
(i.e. stop sched scan if regular scan is being attempted and
vice-versa) if the number of running scans reached the maximum.

Add a function that checks if the maximum number of scans was reached
and stops the appropriate scan to make room for the new scan.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

If a new scan cannot be run for some reason, we shouldn't cancel other
ongoing scans.  Move the checks to before the code that cancels other
scans.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Now that we have separate flags for stopping scans, we don't need to
wait for the scan stopped work to complete before starting the new
scan.  Previously we needed it because we had no way of distinguishing
the scan that was being stopped from the scan that was currently
running.  With the new flags there won't be any confusions and we are
able to handle the stop for the correct type of scan.

Thus we can remove the iwl_mvm_cancel_scan_wait_notif() function.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

LMAC scans cannot handle more than one scan at a time, but UMAC scans
can.  To avoid confusion we should combine the states of these two
types of scans.  To do so, we need to support mutliple scans at the
same time for UMAC.

This commit changes the scan_status element from a single value to a
bitmask of running scan types for LMAC.  Later, we will modify UMAC
scans to use the same state bitmask.

Additionally, add stopping scan flags for scheduled and regular scans.
This makes it easier to differentiate and handle stop requests
triggered by the driver and spontaneous stops generated by the
firmware.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

When user space requests mac80211 to transmit a frame off
channel, mac80211 notifies the driver, and the driver requests
a time event from the ucode, and then transmits the frame.
When the driver requests a time event, it can specify what is the allowed
max delay for starting the time event.

When the max delay is too big, this can cause a timeout in the user space,
that is waiting for the frame to be transmitted.

Currently the max delay is extremely long.

Reduce the max delay for the AUX ROC time event that is sent to the ucode.
Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

During firmware restart, the quota command isn't calculated multiple
times, but after the firmware restart it has to be sent, so force it.
Otherwise the firmware crashes.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The firmware doesn't relate the scan to a vif. The scan is
run by a separate entity called auxiliary MAC (aka AUX MAC).
This AUX MAC needs to get Tx power limitations that are
not applied on a specific vif, but on the device as a whole.

This can be implemented by using the minimum of all the
values set by the user for all the MACs. But then we need
to ignore the limitations that come from the AP or
regulatory for a specific vif: a specific vif might have
regulatory limitations because of the channel is works on.
This limit is irrelevant for the AUX MAC.
Use the new API from mac80211: the user_power_level in
bss_conf to achieve this.

Firmware -13.ucode has already moved to this API.

Change-Id: Ifba83660f378e91b93bd46d29fe8ba35a7c168a4
Signed-off-by: Avri Altman <avri.altman@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The current code has a lot of duplicates of printing into a buffer
(while having to make sure it's NUL-filled and -terminated) and
then passing that to the debug trigger collection.

Since that's error-prone, instead make the debug trigger collection
function take a format string and format arguments (with compiler
validity checking) and handle the buffer internally.

This makes one behavioural change -- instead of sending the whole
buffer to userspace (clearing is needed to not leak stack data) it
just passes the actual string (including NUL-terminator.)
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

If ucode_loaded isn't true the function returns the 'ret' variable
without having assigned a value properly. Fix that.
Reported-by: Haim Dreyfuss <haim.dreyfuss@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

This will allow to catch failures in MLME and get the
firmware data when this happens.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The str/len arguments to iwl_fw_dbg_trigger_simple_stop() aren't used,
and for a simple trigger don't really need to be used as the trigger
code itself encodes the reason, so remove them.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Sending multiple action frames off channel, one after the other can create
a race that will result in a timeout:

1. Start sending action frame off channel.
2. Once the frame is sent or the time event is over, the flow will
eventually call ieee80211_start_next_roc to start the next roc frame &
iwl_mvm_roc_finished schedules to schedule a work to flush the queue.
3. Start sending new roc frame and write it to the queue before the
flush work has started.
4. The work is called and it flushes the new packet that was placed on the
on the queue so the packet is lost.

This causes the frame to be removed & not sent, that causes a timeout in
userspace.

Flush the work queue that flushes the roc/off channel queue before starting
to send a new frame off channel, in order to avoid a race between the new
frame that is transmitted off channel & the flushing of the queue.
Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Currently the last found MCC is reconfigured only in the recovery flow.
But it should always be used when available, for the ifdown/up or
RF-Kill/CT-Kill scenarios.
While at it, fix a couple of bugs in the init-from-last-MCC flow. Return
an error value when a current MCC is not found. Pass on the regdomain to
cfg80211 only if it was changed and don't ignore the return value from
the cfg80211-setter function.
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

In the reset flow, the driver cancels ongoing scan and sends scan
complete notification to mac80211. However it does not clean its UID.
Add cleaning scan UID for the ongoing scan. Loop over all other UIDs
to make sure there's nothing left there and warn if any is found.
Signed-off-by: Alexander Bondar <alexander.bondar@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

These early versions are no longer supported.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The AP_START d0i3 reference was never removed if the AP started correctly.
This has the unpleasant side-effect of preventing D0i3 on Android if the
WiFi hotspot was ever started on the device.
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

In 8000 HW family B-step only, the ICCM is separate
from the SRAM. This adds the ICCM to the dump data
collected for FW debug.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

There are transport that must buffer frames in the driver.
This means that we have frames that are not in the op_mode
and not visible to the firwmare. This causes issues when we
flush the queues: the op_mode flushes a queue, and the
firmware flushes all the frames that are *currently* on the
rings, but if the transport buffers frames, it can submit
these while we are flushing. This leads to a situation
where we still have frames on the queues after we flushed
them.
Preventing those buffered frame from getting into the
firmware is possible, but then, we have to run the Tx
response path on frames that didn't reach the firmware
which is not desirable.
The way I solve this here is to let these frames go to the
firmware, but make sure the firmware will not transmit them
(by setting the station as draining). The op_mode then needs
to wait until the transport itself is empty to be sure that
the queue is really empty.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

If, on a GO, the CSA time event fails to be scheduled, continue the
flow towards mac80211's state machine so it doesn't get stuck, but
report an error later on the post switch which will cause mac80211
to tear down the operation. This ensures nothing gets stuck due to
the scheduling failure.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

When a station goes to sleep, we can't transmit any frame
to it. This means that until that station will wake up, a
queue that is dedicated to this station won't progress at
all. Take this into account when monitoring stuck queues
and don't account for the time the station was asleep.
This allows to mask false positives where the queues are
stuck not because of a bug, but because of the station
being asleep.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

When we associate we always need to update the quotas. This
fixes a bug for cases in which quotas weren't udapted after
association.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

When moving to the D3 FW give it the valid MCC from the D0 FW. When
returning from D3 to D0, query the D3 FW for the latest MCC, as
it might have changed internally. This MCC will be replayed to the D0 FW
when it boots.
Signed-off-by: Jonathan Doron <jonathanx.doron@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

For some configurations, the driver should get the MAC
address from the hardware registers and not from the
regular locations. Since the parsing of the MAC address
is the same regardless of its source, continue the regular
code path (parsing) after we read the registers.
Signed-off-by: Eran Harary <eran.harary@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Otherwise the regulatory data will mistakenly contain only 7000 series
channels.
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Chub (Communication Hub, CommsHUB) is a HW component that connects to the cellular
and connectivity cores that gets updates of mcc changes, and then notifies the FW
directly of any mcc change.

The ucode notifies the driver (via this command) that it should ask for an mcc update,
and the driver sends the ucode the update mcc command to set the updated regulatory info.
Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The commits below broke compilation when
CONFIG_IWLWIFI_DEBUGFS is not set.
FIx that.

Fixes: ddf89ab1 ("iwlwifi: mvm: allow to force the Rx chains from debugfs")
Fixes: 9d761fd8 ("iwlwifi: mvm: add trigger for firmware dump upon missed beacons")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

We fire the trigger when the channel switch starts, but
the delay is configurable. That makes is easier to catch
channel switches that fail.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Now that the firmware dump can be triggered by events in
the code and not only the user or an firmware ASSERT, we
need a way to know why the firmware dump was triggered.
Add a section in the dump file for that.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Most of the time, the issues we want to debug with the
firmware dump mechanism are transient. It is then very
hard to stop the recording on time and get meaningful
data.
In order to solve this, I add here an infrastucture
of triggers. The user will supply a list of triggers
that will start / stop the recording. We have two types
of triggers: start and stop. Start triggers can start a
specific configuration. The stop triggers will be able to
kick the collection of the data with the currently running
configuration. These triggers are given to the driver by
the .ucode file - just like the configuration.

In the next patches, I'll add triggers in the code.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Report the average beacon signal and the number of received beacons as
measured by the firmware.

Since the firmware just counts, and doesn't reset the counter at all,
clear it in the firmware whenever we associate. However, accumulate it
over firmware restart.

Since clearing the statistics in the firmware will also clear the ones
for the radio statistics, add those to the accumulator when cleared.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>