Merge tag 'iwlwifi-next-for-kalle-2016-01-07_2' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next

* bug fixes and improvements for firmware debug system (Golan and myself)
* fixes for D0i3 (Eliad)
* prevent muliple stations with the same MAC address
* advertise support for Rx A-MSDU in A-MPDU
* scan related fixes
* support -20.ucode
* fix WoWLAN for iwldvm
* preparations towards multiple Rx queues
* platform power improvements for GO mode when no clients are associated

No major changes to list.

8000 device family has a new debug engine that needs to be
configured differently than 7000's.
The debug engine's DMA works in chunks of memory and the
size of the buffer really means the start of the last
chunk. Since one chunk is 256-byte long, we should
configure the device to write to buffer_size - 256.
This fixes a situation were the device would write to
memory it is not allowed to access.

CC: <stable@vger.kernel.org> [4.1+]
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When iwl_mvm_fw_error_dump fails, it needs to clear the
state in mvm, which includes:
	* clear IWL_MVM_STATUS_DUMPING_FW_LOG
	* set mvm->fw_dump_trig to NULL
	* free the description

While at it, remove a NULL check in
iwl_mvm_free_fw_dump_desc since kfree is NULL safe.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The debug functions of fw-dbg.c don't really need to modify
the trigger and the description they receive as a parameter.
Constify the pointers.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This notification will be extended with extra data, so just
check that it has a minimum length, not the exact length;
we might later add handling for the extra fields added and
have more code to handle both versions.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

gtkdata->mvm wasn't set in iwl_mvm_d0i3_update_keys,
resulting in kernel panic in some flows (when mvm
is actually used...)

Fixes: a3f7ba5c ("iwlwifi: update key params on d0i3 entrance/exit")
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

As we're working on multi-queue RX, we want to parallelise checking
the PN in order to avoid having to serialise the RX processing.

It may seem that doing parallel PN checking is insecure, but it turns
out to be OK because queue assignment is done based on the data in the
frame (IP/TCP) and thus cannot be manipulated by an attacker, since
the data is encrypted and must first have been decrypted successfully.

There are some corner cases, in particular when the peer starts using
fragmentation which redirects the packet to the default queue. However
this redirection is remembered (for the STA, per TID) and thus cannot
be exploited by an attacker either.

Leave checking on the default queue (queue 0) to mac80211, since we
get fragmented packets there and those are subject to stricter checks
during reassembly.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The commit below called iwl_mvm_mac_ctxt_changed() to handle
a case that the vif is a P2P GO.
However iwl_mvm_mac_ctxt_cmd_go() ignores the number of
associated stations and asks the FW to pass beacons anyways.

Fix this by checking ap_assoc_sta_count parameter, in iwl_mvm_mac_ctxt_cmd_go()
as well, and ask the FW to pass beacons only when there's
at least one associated station.
Signed-off-by: NAyala Beker <ayala.beker@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

As the device (and parts of the driver) cannot deal with having the
same MAC address for two stations (on two virtual interfaces), add
some explicit code to prevent this case.

Note that in practice this cannot happen since the device doesn't
support operating with two AP/GO interfaces at the same time either,
and other scenarios for this are, while not impossible, not going to
happen in practice.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

We advertise one STATION vif only, so this just can't
happen. Remove this useless WARN_ON.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Since A-MPDU deaggregation is done in hardware, and A-MSDU deaggregation
is done in software, there's no reason not to support A-MSDU in A-MPDU;
set the flag to support it.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Allow the user to configure a non-trigger session - a window
between triggers in which the driver won't collect fw debug data.
This can be useful when the frequent collection of fw data
has an impact on the performance, such as debugging
tx flows.
Signed-off-by: NGolan Ben-Ami <golan.ben.ami@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Dumping the content of the radio registers greatly helps
to debug PHY issues, which can lead to TFD queue hang.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

FW adds 10 msec for every dwell time in low band, so we need
to set 10 msec less.
Don't use extended dwell time when fragmented scan is needed
because FW adds 3 msec per probe and it can easily exceed
max out of channel time.

Fixes: c3e230b1 ("iwlwifi: mvm: add extended dwell time")
Signed-off-by: NDavid Spinadel <david.spinadel@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Fix loading the default NVM file, in the case where the
requested NVM file isn't found in the file system.
Signed-off-by: NOren Givon <oren.givon@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

7265D and up are now able to handle -20.ucode.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Just like 7260, 7265 will not have firmware releases newer
than iwlwifi-7265-17.ucode. 7265D is still supported in
latest firmware releases.

Fixes: 628a2918 ("iwlwifi: separate firmware version for 7260 devices")
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

If we don't reset the scan type when the firmware is
started, we will think the firmware is still configured
after the interface has been brought down. When we will
bring it up again, we will not configure the scan type
in firmware and it will crash with the following assert:

0x0000100A | ADVANCED_SYSASSERT

Fixes: 355346ba ("iwlwifi: mvm: configure scheduled scan according to traffic conditions")
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

New functionality for testing that is not relevant for
this driver has been added. This required an API change.

Add new cmd & response versions for the MCC update cmd & response.
Add new TLV indicating that the FW is using the new API.
Signed-off-by: NMatti Gottlieb <matti.gottlieb@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The firmware knows better what antenna to choose.
Old firmware still need the setting, so use a flag to know
if the driver should choose the antenna or if the firmware
can do it iself.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Update and fix some 7265 PCI IDs entries.

CC: <stable@vger.kernel.org> [3.13+]
Signed-off-by: NOren Givon <oren.givon@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

My commit below introduced a mutex in the transport to
prevent concurrent operations. To do so, it added a flag
(is_down) to make sure the transport is in the right state.
This uncoverred an bug that didn't cause any harm until
now: iwldvm calls stop_device and then starts the firmware
without calling start_hw in between. While this flow is
fine from the device configuration point of view (register,
etc...), it is now forbidden by the new is_down flag.
This led to this error to appear:
iwlwifi 0000:05:00.0: Can't start_fw since the HW hasn't been started
and the suspend would fail.

This fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=109591

CC: <stable@vger.kernel.org> [4.3+]
Reported-by: NBogdan Bogush <bogdan.s.bogush@gmail.com>
Fixes=fa9f3281 ("iwlwifi: pcie: lock start_hw / start_fw / stop_device")
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Per comments from Bjorn Andersson <bjorn.andersson@sonymobile.com>,
split DMA mask register writing as seperate patch in case we need
bi-sect in the furture.
Signed-off-by: NFengwei Yin <fengwei.yin@linaro.org>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Lawrence reported that git clone could make system crash on a
Qualcomm ARM soc based device (DragonBoard, 1G memory without
swap) running 64bit Debian.

It's turned out the crash is related with rx skb allocation
failure. git could consume more than 600MB anonymous memory.
And system is in extremely memory shortage case.

But driver didn't handle the rx allocation failure case. This patch
doesn't submit skb to upper layer if rx skb allocation fails.
Instead, it reuse the old skb for rx DMA again. It's more like
drop the packets if system is in memory shortage case.

With this change, git clone is OOMed instead of system crash.
Reported-by: NKing, Lawrence <lking@qti.qualcomm.com>
Signed-off-by: NFengwei Yin <fengwei.yin@linaro.org>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

There is a type bug so it always returns success.

Fixes: 6fa658fd ('ath9k: Simplify and fix eeprom endianness swapping')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Ath9k driver does not modify tx skbs, so SUPPORTS_CLONED_SKBS
flag can be set. Enabling this flag significant reduce number
of copy operation during TCP Tx. This is especially noticeable
on platforms with slower CPU (lower CPU usage brings
profits in better TCP Tx troughput results).

Tested on MIPS with 560 MHz clock
Without CLONED_SKBS flag:
TCP Tx 145 Mb/s (iperf result)
__copy_user_common consumes 12.9% of CPU (result from perf tool)
0% CPU Idle

With CLONED_SKBS flag:
TCP Tx 170 Mb/s (iperf result)
__copy_user_common consumes 1.8% of CPU (result from perf tool)
12% CPU Idle
Signed-off-by: NPawel Kulakowski <pawel.kulakowski@tieto.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Added a simple interface for platform to perform crash
recovery.
When firmware crashes, wil driver can notify the platform
which can trigger a crash recovery process. During
the process the platform can request a ram dump
from the wil driver as well as control when firmware
recovery will start. This interface allows the platform
to implement a more advanced crash recovery, for
example to reset dependent subsystems in proper order, or
to provide its own notifications during the recovery process.
Signed-off-by: NLior David <qca_liord@qca.qualcomm.com>
Signed-off-by: NMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

When network interface is stopping, some resources may
be already released by the network stack, and Rx frames
cause kernel OOPS (observed one is in netfilter code)

Proper solution is to drop packets pending in reorder buffer.
Signed-off-by: NHamad Kadmany <qca_hkadmany@qca.qualcomm.com>
Signed-off-by: NVladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: NMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Use SMPS disabled as default because FW does not indicate
any support of SMPS.

This change will help STAs out that don’t support SMPS from
sticking on 1SS, since they don’t have method to change it
back to multiple chains.

This change also should not affect power consumption of STAs
supporting SMPS, because they are capable to switch the mode
to dynamic or static either at the end of frame sequence or
by using SMPS action frame.
Signed-off-by: NPeter Oh <poh@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The driver calls pci_set_mwi to enable memory-write-invalidate when it
is initialized, but does not call pci_clear_mwi when it is removed. Many
other drivers calls pci_clear_mwi when pci_set_mwi is called, such as
r8169, 8139cp and e1000.

This patch adds pci_clear_mwi in error handling and removal procedure,
which can fix the problem.
Signed-off-by: NJia-Ju Bai <baijiaju1990@163.com>
Acked-by: NHelmut Schaa <helmut.schaa@googlemail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The module parameter can be used to ensure the probe succeeds thus
claiming the device and allowing post-mortem debugging in case of
firmware crash. It is only available when select CONFIG_BRCMDBG.
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Module parameters are defined in several files. Move them in one
place and make them device specific or global. This makes it
easier to override device specific settings by external data like
platform data in the future.
Reviewed-by: NArend Van Spriel <arend@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NHante Meuleman <meuleman@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

When the driver is being unloaded a situation can occur where the
wirelesss core (cfg80211) wants to remove the ibss, but the state
of brcmfmac has already been set to down. When an error is
returned in that situation then that will result in a stack
trace on removal of the wiphy object. This is avoided by
returning 0 when device is down on a leave_ibss call.
Reviewed-by: NArend Van Spriel <arend@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NHante Meuleman <meuleman@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Several features in the driver directly map to a firmware feature
listed in response of the 'cap' firmware command. For those features
this response will be examined instead of attempting individual
firmware commands.
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Reviewed-by: NMathy Vanhoef <vanhoefm@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Scheduled scan be requested to use mac randomization. This patch
checks the flags and enables the randomization if desired.
Reviewed-by: NArend Van Spriel <arend@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NHante Meuleman <meuleman@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

When get_station is requested for IBSS then an error will be
printed and no information will be returned. This patch adds
IBSS specific get station information function.
Reviewed-by: NArend Van Spriel <arend@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NHante Meuleman <meuleman@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Obtain ipv4 address through inetaddr notification for ARP offload host
ip table configuration.
Reviewed-by: NArend Van Spriel <arend@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Signed-off-by: NFranky Lin <frankyl@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

ipw2100_alloc_skb() and ipw2100_tx_send_data() do not check if mapping
dma memory succeed. The patch adds the checks and failure handling.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Driver supports Tx status ack feature. When hostapd/
wpa_supplicant asks for ack status of an EAPOL/ACTION
frame, driver maintains a cloned skb for the packet
until TX_STATUS event is received from firmware.

Cloned skb queue gets flushed when connection is terminated
or driver is unloaded.

Let's reduce the queue size to avoid unnecessarily
keeping memory allocated when environment is busy.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>