8000 device family has a new debug engine that needs to be
configured differently than 7000's.
The debug engine's DMA works in chunks of memory and the
size of the buffer really means the start of the last
chunk. Since one chunk is 256-byte long, we should
configure the device to write to buffer_size - 256.
This fixes a situation were the device would write to
memory it is not allowed to access.

CC: <stable@vger.kernel.org> [4.1+]
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

When iwl_mvm_fw_error_dump fails, it needs to clear the
state in mvm, which includes:
	* clear IWL_MVM_STATUS_DUMPING_FW_LOG
	* set mvm->fw_dump_trig to NULL
	* free the description

While at it, remove a NULL check in
iwl_mvm_free_fw_dump_desc since kfree is NULL safe.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The debug functions of fw-dbg.c don't really need to modify
the trigger and the description they receive as a parameter.
Constify the pointers.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

This notification will be extended with extra data, so just
check that it has a minimum length, not the exact length;
we might later add handling for the extra fields added and
have more code to handle both versions.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

gtkdata->mvm wasn't set in iwl_mvm_d0i3_update_keys,
resulting in kernel panic in some flows (when mvm
is actually used...)

Fixes: a3f7ba5c ("iwlwifi: update key params on d0i3 entrance/exit")
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

As we're working on multi-queue RX, we want to parallelise checking
the PN in order to avoid having to serialise the RX processing.

It may seem that doing parallel PN checking is insecure, but it turns
out to be OK because queue assignment is done based on the data in the
frame (IP/TCP) and thus cannot be manipulated by an attacker, since
the data is encrypted and must first have been decrypted successfully.

There are some corner cases, in particular when the peer starts using
fragmentation which redirects the packet to the default queue. However
this redirection is remembered (for the STA, per TID) and thus cannot
be exploited by an attacker either.

Leave checking on the default queue (queue 0) to mac80211, since we
get fragmented packets there and those are subject to stricter checks
during reassembly.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The commit below called iwl_mvm_mac_ctxt_changed() to handle
a case that the vif is a P2P GO.
However iwl_mvm_mac_ctxt_cmd_go() ignores the number of
associated stations and asks the FW to pass beacons anyways.

Fix this by checking ap_assoc_sta_count parameter, in iwl_mvm_mac_ctxt_cmd_go()
as well, and ask the FW to pass beacons only when there's
at least one associated station.
Signed-off-by: Ayala Beker <ayala.beker@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

As the device (and parts of the driver) cannot deal with having the
same MAC address for two stations (on two virtual interfaces), add
some explicit code to prevent this case.

Note that in practice this cannot happen since the device doesn't
support operating with two AP/GO interfaces at the same time either,
and other scenarios for this are, while not impossible, not going to
happen in practice.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

We advertise one STATION vif only, so this just can't
happen. Remove this useless WARN_ON.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Since A-MPDU deaggregation is done in hardware, and A-MSDU deaggregation
is done in software, there's no reason not to support A-MSDU in A-MPDU;
set the flag to support it.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Allow the user to configure a non-trigger session - a window
between triggers in which the driver won't collect fw debug data.
This can be useful when the frequent collection of fw data
has an impact on the performance, such as debugging
tx flows.
Signed-off-by: Golan Ben-Ami <golan.ben.ami@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Dumping the content of the radio registers greatly helps
to debug PHY issues, which can lead to TFD queue hang.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

FW adds 10 msec for every dwell time in low band, so we need
to set 10 msec less.
Don't use extended dwell time when fragmented scan is needed
because FW adds 3 msec per probe and it can easily exceed
max out of channel time.

Fixes: c3e230b1 ("iwlwifi: mvm: add extended dwell time")
Signed-off-by: David Spinadel <david.spinadel@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Fix loading the default NVM file, in the case where the
requested NVM file isn't found in the file system.
Signed-off-by: Oren Givon <oren.givon@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

7265D and up are now able to handle -20.ucode.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Just like 7260, 7265 will not have firmware releases newer
than iwlwifi-7265-17.ucode. 7265D is still supported in
latest firmware releases.

Fixes: 628a2918 ("iwlwifi: separate firmware version for 7260 devices")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

If we don't reset the scan type when the firmware is
started, we will think the firmware is still configured
after the interface has been brought down. When we will
bring it up again, we will not configure the scan type
in firmware and it will crash with the following assert:

0x0000100A | ADVANCED_SYSASSERT

Fixes: 355346ba ("iwlwifi: mvm: configure scheduled scan according to traffic conditions")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

New functionality for testing that is not relevant for
this driver has been added. This required an API change.

Add new cmd & response versions for the MCC update cmd & response.
Add new TLV indicating that the FW is using the new API.
Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The firmware knows better what antenna to choose.
Old firmware still need the setting, so use a flag to know
if the driver should choose the antenna or if the firmware
can do it iself.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Update and fix some 7265 PCI IDs entries.

CC: <stable@vger.kernel.org> [3.13+]
Signed-off-by: Oren Givon <oren.givon@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

My commit below introduced a mutex in the transport to
prevent concurrent operations. To do so, it added a flag
(is_down) to make sure the transport is in the right state.
This uncoverred an bug that didn't cause any harm until
now: iwldvm calls stop_device and then starts the firmware
without calling start_hw in between. While this flow is
fine from the device configuration point of view (register,
etc...), it is now forbidden by the new is_down flag.
This led to this error to appear:
iwlwifi 0000:05:00.0: Can't start_fw since the HW hasn't been started
and the suspend would fail.

This fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=109591

CC: <stable@vger.kernel.org> [4.3+]
Reported-by: Bogdan Bogush <bogdan.s.bogush@gmail.com>
Fixes=fa9f3281 ("iwlwifi: pcie: lock start_hw / start_fw / stop_device")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

In case of bad trans state (i.e. fw is not loaded) bail
out immediately instead of calling the trans, which might
not be fully initialized yet.

Also add WARN_ON_ONCE to help debugging where the errorneous
call is coming from.
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Smatch warned about a bad specifier being used. Fix that.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

All the callers used silent = false.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

In order to let the fw do offloading properly, we need
to provide various key data (e.g. PN).

Configure the params on d0i3 entrance, and update them
back on d0i3 exit.

Since d3 code is now called in d0i3 which requires runtime
pm only, make d3.0 depend on CONFIG_PM (rather than
CONFIG_PM_SLEEP), and add required #ifdefs and wrappers
where needed, so both CONFIG_PM=n and CONFIG_PM_RUNTIME=n
configurations will build correctly.
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Currently, the number of associated stations gets updated when adding
a new station or removing it. This is incorrect as it's possible that
a station was inserted before it was associated
Fix this by increasing/decreasing ap_assoc_sta_count whenever
a station transitions in/out the associated state.
Signed-off-by: Ayala Beker <ayala.beker@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

A new PCI IDs update to the 8000 and 9000 series.

type=feature
Signed-off-by: Oren Givon <oren.givon@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

These registers can help to debug PHY issues. Since this
adds a significant amount of work to the debug collection
phase, dump the periphery registers only if the firmware
is stopped.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Incoming hardware will send frame release notifications to
the reorder buffer in order to update with the BA session
status and up to date NSSN.
This patch enables the API.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Convert the convert the new infrastructure added by previous
patches to actually use the new RX descriptor layout.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The code in iwl_mvm_update_tkip_key() is now pretty much duplicated
with the code in iwl_mvm_get_key_sta_id() doing the station ID lookup
again after it was already done. Change iwl_mvm_get_key_sta_id() to
iwl_mvm_get_key_sta(), returning the mvm_sta pointer, to allow that
duplicate code to be removed.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Currently when creating a new vif in monitor mode the driver doesn't
allocate a specific station. This causes that in the situation that
tx traffic is injected, the tx queues are not scheduled,
with the result of a TFD queue hang.
Fix that by allocating a station and ensuring its tx queues
are scheduled.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=104591Signed-off-by: Chaya Rachel Ivgi <chaya.rachel.ivgi@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

When doing active scan on crowded channels we are likely to miss probe
responses due to collisions. To overcome this issue we use an extended
dwell time on channels 1, 6 and 11; this dwell time is set to 100.

In case of fragmented scan extended dwell time is the maximum out of
channel time - 44 msec. Fragmented active scan will be addressed later.

Extended dwell time isn't used in sched scan or p2p find.
Signed-off-by: David Spinadel <david.spinadel@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Small change in firmware API, no functional change.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Add to the user triggered fw debug collection support for describing
the reason of the trigger.
This could be useful for identifying a dump by a unique id, passed as
a description.
Signed-off-by: Golan Ben-Ami <golan.ben.ami@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Firmware will support filtering multicast L3 packets.
The L3 filtering is configured by the WOWLAN_CONFIG command.
All flags should be enabled by default.
Older firmware is not affected as it does not look into
this field.
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Instead of keeping the fw_key_table bits set when the keys are removed
(i.e. in D3 entry or HW_RESTART flows), clear them and set them again
only when the keys have been successfully re-added.  This makes the
bitmask more closely tied to the actual firmware programming.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

9000 family devices have 31 queues.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

When the op_mode sends an skb whose payload is bigger than
MSS, PCIe will create an A-MSDU out of it. PCIe assumes
that the skb that is coming from the op_mode can fit in one
A-MSDU. It is the op_mode's responsibility to make sure
that this guarantee holds.

Additional headers need to be built for the subframes.
The TSO core code takes care of the IP / TCP headers and
the driver takes care of the 802.11 subframe headers.

These headers are stored on a per-cpu page that is re-used
for all the packets handled on that same CPU. Each skb
holds a reference to that page and releases the page when
it is reclaimed. When the page gets full, it is released
and a new one is allocated.

Since any SKB that doesn't go through the fast-xmit path
of mac80211 will be segmented, we can assume here that the
packet is not WEP / TKIP and has a proper SNAP header.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The transport will need to use the info->driver_data
pointers. Since the op_mode has this memory hot in cache,
clear it there.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>