Add the location/time-of-flight/FTM APIs that we'll use in
follow-up patches to implement FTM responder and initiator.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

Some buggy APs stop sending beacons, but continue to ack our null data
packets or even run some traffic. It's better not to stick connected to
such an AP forever, so disconnect after some larger beacon loss
threshold is crossed.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

That's what we pass, and we don't want/need any negative values.
Found by sparse/smatch.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

If we're in the else branch of checking "tt->state == IWL_TI_CT_KILL"
so there's no point in checking "tt->state != IWL_TI_CT_KILL" again.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

This is an ancient (~2015) implementation that no longer matches
the firmware in any way, and most likely never worked. Remove all
of it so it can be reintroduced properly.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

TX path lock was introduced in order to prevent out of order
invocations of TX.

This can happen in the following flow:

TX path invoked from net dev
Packet dequeued
	TX path invoked from RX path
	Packet dequeued
	Packet TXed
Packet TXed

However, we don't really need a lock. If TX path is already
invoked from some location, other paths can simply abort their
execution, instead of waiting to the first path to finish, and
then discover queue is (likely) empty or stopped.

Replace the lock with an atomic variable to track TX ownership.
This simplifies the locking dependencies between RX and TX paths,
and should improve performance.
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

The current code assigns the reference, and then goes to increment
it if the toggle bit has changed. That way, we get

Toggle  0  0  0  0  1  1  1  1
ID      1  1  1  1  1  2  2  2

Fix that by assigning the post-toggle ID to get

Toggle  0  0  0  0  1  1  1  1
ID      1  1  1  1  2  2  2  2
Reported-by: Danny Alexander <danny.alexander@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Fixes: fbe41127 ("iwlwifi: mvm: update mpdu metadata API")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

Currently whenever we get firmware notification with mac id,
we iterate over all the interfaces to find the ID. This is a
bit cumbersome. Instead, adding an array of RCU pointers, like
we have for station IDs. This is not expensive space wise
since we have only up to 4 active MACs, and not complicated
code wise, since we have a clear point to init and de-init it.
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

Since we use a dumping mask, checking if only monitor was requested
is redundant. Remove the unneeded code.
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

If WEP is used, no one removes the STA key upon STA
removal, leading to a situation where after 16
connect/disconnects - the AP could no longer decrypt
incoming data frames since iwl_mvm_set_fw_key_idx()
called from iwl_mvm_set_sta_key() during association
returns STA_KEY_IDX_INVALID, thus not setting the key
for that connecting STA.

Fix this by removing the key in the driver when the
STA is removed.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

Harden the fwrt->fw->img array access by making sure the cur_fw_img
value doesn't go out of bounds.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

The out_cmd structure starts with a header, so there's no need to use
&out_cmd->hdr, out_cmd alone is enough.  We use this when calculating
other addresses and klocwork gets confused with that because it thinks
we are trying to access hdr (as an array) beyond its size.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

The function we pass to the wait alive notification procedure may may
not even get called if the timeout occurs before the function is
called.  To prevent accessing unitialized data in alive_data, pre-set
it to zero in the declaration.  Found by static analyzers.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

These inlines just check the module parameters, so they don't
need a configuration parameter and can move to a better place.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

This function is supposed to be used as an inline function and is in a
header file, so make it inline.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

Sometimes we want to debug issues related to the regulatory blob in
the NVM.  To make that easier, add a debugfs entry to export it
together with the other nvm blobs we export.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

Clean up the LDBG config command to not be called "continuous
recording", and while at it actually remove the continuous
recording implementation completely since it was only used for
store & forward architectures.

This also fixes a bug at least in iwl_fw_dbg_buffer_allocation()
because what's now "__le32 type" (matching the firmware) used to
be "__le16 enable_recording", so the buffer allocation config
sub-struct would erroneously have started at the wrong offset.
In the other cases this didn't actually lead to a bug as other
bytes in pad[] were all zeroes, so accessing the 16-bit value as
a 32-bit value wouldn't make a difference (in little endian.)
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

These files have a long history of code changes, but analysing
the remaining code leads to having only a few changes that are
not already owned by Intel, notably from
 - Andy Lutomirski <luto@amacapital.net>
 - Joonwoo Park <joonwpark81@gmail.com>
 - Kirtika Ruchandani <kirtika@chromium.org>
 - Rajat Jain <rajatja@google.com>
 - Stanislaw Gruszka <sgruszka@redhat.com>
remaining in the code today.

Note that
 - I myself was working for Intel and for any possibly code
   that might be before my employment there give permission
 - Wizery employees were working for Intel

More specifically, we identified the following commits that
(partially may) remain today:

25c03d8e Joonwoo Park <joonwpark81@gmail.com>      ("iwlwifi: do not schedule tasklet when rcv unused irq")
f36d04ab Stanislaw Gruszka <sgruszka@redhat.com>   ("iwlwifi: use dma_alloc_coherent")
387f3381 Stanislaw Gruszka <sgruszka@redhat.com>   ("iwlwifi: fix dma mappings and skbs leak")
2624e96c Stanislaw Gruszka <sgruszka@redhat.com>   ("iwlwifi: fix possible data overwrite in hcmd callback")
bfe4b80e Stanislaw Gruszka <sgruszka@redhat.com>   ("iwlwifi: always check if got h/w access before write")
d536c32b Andy Lutomirski <luto@amacapital.net>     ("iwlwifi: pcie: log when waking the NIC for hcmd submission fails")
a6d24fad Rajat Jain <rajatja@google.com>           ("iwlwifi: pcie: dump registers when HW becomes inaccessible")
fb12777a Kirtika Ruchandani <kirtika@chromium.org> ("iwlwifi: Add more call-sites for pcie reg dumper")
3a73a300 Stanislaw Gruszka <sgruszka@redhat.com>   ("iwlwifi: cleanup/fix memory barriers")
aa5affba Stanislaw Gruszka <sgruszka@redhat.com>   ("iwlwifi: dump stack when fail to gain access to the device")

Align the licenses with their permission to clean up and to
make it all identical.

CC: Joonwoo Park <joonwpark81@gmail.com>
CC: Stanislaw Gruszka <sgruszka@redhat.com>
CC: Andy Lutomirski <luto@amacapital.net>
CC: Rajat Jain <rajatja@google.com>
CC: Kirtika Ruchandani <kirtika@chromium.org>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Acked-by: Kirtika Ruchandani <kirtika@chromium.org>
Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
Acked-by: Joonwoo Park <joonwpark81@gmail.com>
Acked-by: Rajat Jain <rajatja@google.com>
Acked-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

Due to a general shortage of RX API bits, the firmware is going
to reuse this bit on non-CCK frames to mean something else. Use
it only on CCK frames to prepare for that change.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

With just %16, it means 16 characters padding, but we really
don't want to print "0x         1F4547B", but instead want to
have this filled with zeroes, so we need the 0.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

In case there are bugs in this area, this data can
help with debugging.
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

Take the NSS value from 'rx_vec' rather than from 'rate_n_flags'.
The rate_n_flags has only 2 bits for the NSS giving a max of 4SS
(0 = 1SS etc.). Since there may be up to 8SS use the rx_vec which
has 3 bits for the NSS.
While at it, fix the rx_vec array to length of 2.
Signed-off-by: Shaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

When setting the EOF bit in Rx flags (propagated
to radiotap) do not depend it on the PPDU type (SU/MU/TB)
since it doesn't.
Signed-off-by: Shaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

The code checks that we haven't exceeded the maximum number of
TBs by comparing to a define of gen1 instead of gen2, fix it.
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

Merge tag 'iwlwifi-next-for-kalle-2019-01-25' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next

First batch of iwlwifi patches intended for v5.1

* Support for Target Wakeup Time (TWT) -- a feature that allows the AP
  to specify when individual stations can access the medium;
* Support for mac80211 AMSDU handling;
* Debugging infrastructure work;
* Preparations for improvements in the device selection code;
* Some new PCI IDs;
* Some updates in the documentation;
* A bunch of fixes for issues found with static analyzers;
* A couple of janitorial fixes from the community;
* Some fixes in P2P;
* Other cleanups and small fixes;

Document the WoWLAN patterns command structure.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

These are unused by both firmware and driver, remove them.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

The value in num_lmac can be bigger than mem_cfg->lmac array,
warn in case it's bigger.
Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: 68025d5f ("iwlwifi: dbg: refactor dump code to improve readability")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

The value in txq_id can be out of array scope,
validate it before accessing the array.
Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: cf961e16 ("iwlwifi: mvm: support dqa-mode agg on non-shared queue")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

Klocwork complains about copying from dev_cmd->hdr if
copying more than 4 bytes since it means part of the
copy is from the next field. This isn't a real bug,
but for not failing Klocwork next time - fix this.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

The driver assumes certain sizes and lengths aren't crossed in some
places.  Make sure this indeed happens.

Found by Klocwork.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

There is no point in having num_active_macs signed
since it should never be negative. Set it to be an
unsigned variable to ensure this.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

A few commands refer to a struct that no longer exists
in the mentioned name. Our trace-cmd parsing scripts
rely on these mentioned names and can't find them,
resulting in these commands not being parsed nicely.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

As this is not needed and might cause interoperability issues
during pairing with devices that would not reply to RTS frames.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

When a frame is transmitted without a station, need to set the rate
and flags in the Tx command, as the FW does not have any information as
to what rate and flags should be used for this frame.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

When a time event for a P2P Device interface is done, it is possible
that there is still a frame pending for transmission that should be
flushed.

Set the IWL_MVM_STATUS_NEED_FLUSH_P2P to indicate to the ROC worker
that P2P Device station queue need also to be flushed.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

We have a slightly better TCP performance with GSO.
Add it back, it can co-exist with the code that builds
AMSDUs in mac80211.
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

Trivial fix to spelling mistake in IWL_ERR error message
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

Use kmemdup rather than duplicating its implementation in
iwl_parse_nvm_mcc_info().
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

We erroneously had some values for NGI in the table we give as an
example in rs_fill_rates_for_column(), when they should be SGI.
Change them so that they match what we say.
Reported-by: Rémy Grünblatt <remy@grunblatt.org>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>