Add a new state to enum iwl_mvm_agg_state, which is used between
queueing the work that starts tx aggregations and actually starting that
work (changing to state IWL_AGG_STARTING).
This solves a race where ieee80211_start_tx_ba_session is called a
second time, before the work queued by the first run has a chance to
change the agg_state. In this case the second call to
ieee80211_start_tx_ba_session returns an error, and the fallback is to
abort the ba session start.

Fixes: 482e4844 ("iwlwifi: mvm: change open and close criteria of a BA session")
Signed-off-by: NNaftali Goldstein <naftali.goldstein@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

AP interfaces now send all non-bufferable frames using the broadcast
station. Thus allow them to use the probe queue and don't warn about
it.

Fixes: eb045e6e ("iwlwifi: mvm: Avoid deferring non bufferable frames")
Signed-off-by: NAvraham Stern <avraham.stern@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

When starting wowlan mac80211 requests flush w/o vif
and we ignore this request. As a result some packets
stay stuck in the queue and it may end up with a queue
hang.

Allow the driver to flush queues even if station isn't
specified.
Signed-off-by: NDavid Spinadel <david.spinadel@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

If we set disconnect on wowlan and run suspend/resume, will run
into:
...snipped
iwlwifi 0000:01:00.0: Failed to load firmware chunk!
iwlwifi 0000:01:00.0: Could not load the [0] uCode section
iwlwifi 0000:01:00.0: Failed to start INIT ucode: -110
iwlwifi 0000:01:00.0: Failed to run INIT ucode: -110
iwlwifi 0000:01:00.0: Failed to start RT ucode: -110

It is because we still keep IWL_MVM_STATUS_IN_HW_RESTART in
__iwl_mvm_resume.  When mac80211 starts the device as
__iwl_mvm_mac_start(), we will miss iwl_mvm_restart_cleanup(mvm).
Signed-off-by: NMatt Chen <matt.chen@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The LEDS_CMD command is only supported in some newer FW versions
(e.g. iwlwifi-8000C-31.ucode), so we can't send it to older versions
(such as iwlwifi-8000C-27.ucode).

To fix this, check for a new bit in the FW capabilities TLV that tells
when the command is supported.

Note that the current version of -31.ucode in linux-firmware.git
(31.532993.0) does not have this capability bit set, so the LED won't
work, even though this version should support it.  But we will update
this firmware soon, so it won't be a problem anymore.

Fixes: 7089ae63 ("iwlwifi: mvm: use firmware LED command where applicable")
Reported-by: NLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Use bcast station for all non bufferable frames on AP and AD-HOC.

The host is no longer aware of STAs PS status because of buffer
station offload, so we can't rely on mac80211 to toggle on
IEEE80211_TX_CTL_NO_PS_BUFFER bit.

A possible issue with buffering such frames, beside the obvious spec
violation, is when a station disconnects while in PS but the AP isn't
aware of that. In such scenarios the AP won't be able to send probe
responses or auth frames so the STA won't be able to reconnect and
the AP will have a queue hang.

Fixes: 3e56eadf ("iwlwifi: mvm: implement AP/GO uAPSD support")
Signed-off-by: NDavid Spinadel <david.spinadel@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Unlike the other sections of the NVM, the hw section is in big-endian.
To read a value from it, we had to cast it to __be16.  Fix that by
using __be16 * for the entire section.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

At this point we have already copied the cfg pointer to mvm and we
have been dereferencing this pointer many times before, so it will
never be NULL or we would have crashed.  Remove the useless check.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

We always call iwl_nvm_init() with read_nvm_from_nic == true, so this
argument is useless.  Remove it.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Tx BA session should be started according to the current throughput
without any dependence on the internal rate scaling state. The criteria
for opening a BA session will be 10 frames per second.

Sending frequent del BAs can cause inter-op issues with some APs. We'll
not close a BA session until we receive an explicit del BA from the
peer.
Signed-off-by: NGregory Greenman <gregory.greenman@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The code did not consider the case that the channel switch counter
is <= 1, which would result with an inaccurate calculation of the
time event apply time.

As the specification states that in case of counter == 0 the switch
occurs at any time after the reception the frame, and for counter == 1
the switch would happens before the next TBTT, schedule the time
event immediately.
Signed-off-by: NIlan Peer <ilan.peer@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Move the BT_MBOX_PRINT() macro from mvm/debugfs.c to fw/api/coex.h so
it can be reused and remove duplicate definition of BT_MBOX_MSG(),
keeping only the one already in coex.h.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

When we flush a queue, the packets will have a 'failed'
status but we shouldn't send a BAR. This check was missing.
Because of that, when we got an ampdu_action with
IEEE80211_AMPDU_TX_STOP_FLUSH, we started the following
ping pong with the firmware:

1) Set the station as 'draining'
2) Get a failed Tx status (DRAINED)
3) Send a BAR because of the failed Tx status

(loop of 2 and 3)

This loop wasn't endless since the BAR isn't sent on a
queue that would trigger a "nested" BAR.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

If a time event is already scheduled when trying to schedule one for
channel switch, the code assumes the channel switch is already
scheduled and no further action is required.
However, it is possible that the scheduled time event is actually
for session protection (e.g. when the first beacon after association
contains the CSA IE). In this case the channel switch will not be
scheduled which will finally lead to disconnection.

Fix this by removing the old time event and schduling a new one for
the channel switch.
Signed-off-by: NAvraham Stern <avraham.stern@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The firmware team is now re-using a bit that hasn't been
used for a few generations. Re-use for TX_ON_AIR drop.
This bit will be set by the firmware to indicate that
a frame in an A-MPDU was dropped but not because of the
already mapped reasons.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

We use mvmsta for the sta->drv_priv in mvm, but in rs.c we have a
bunch of instances using sta_priv, which is probably due to it being
copied from dvm.  Change all occurrences to mvmsta for consistency
with the rest of the driver
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

We have some of the SAR dummy functions when ACPI is not set declared
in mvm.h and some declared in fw.c.  Group them all together in fw.c
for consistency and to avoid static/non-static issues.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

When we get a valid baid in a received frame, we need to
check that we are aware of this baid. If not, we check
that the OLD_SN bit set. If that's not the case, we issue
a WARNING. Print more data when that happens.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

This name was missing in the list.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The firmware now adds more information about time sharing
with the Bluetooth core.
Adapt the API structures and add the new fields in the
debugfs hooks.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

There's no need to differentiate an INIT that ended early because of
RFKILL from one that succeded.  Additionally, if INIT fails later,
during calibration, due to RFKILL, we can just return success and
continue as if we were already in RFKILL to start with.

Remove this unnecessary differentiation and do some other small
clean-ups while at it.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The corunning block was supposed to help in coex scenarios.
It required the driver to configure the firmware based on
the coupling between the two antennas of the devices.
This was never in use and the configuration sent by the
driver has always been blank.
Remove all that code.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The firmware API defined in the header files didn't match
the structure that are actually passed by the firmware.
The impact could be a decision for MIMO in Tx or Rx in
coex scenarios.

Fixes: 430a3bba ("iwlwifi: mvm: BT Coex - new API")
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

One of the queue config params is the associated station id.
Hence the FW must know about the station prior to the queue allocation.
In a000 devices, allocating a queue without a valid station
results with assert 0x2B00.
In FW restart flow the queues are allocated before
adding the station so first add the station.
Signed-off-by: NShaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Fix this issue if it is not supported by the firmware.

Fixes: 00f481bd ("iwlwifi: mvm: add ctdp operations to debugfs")
Signed-off-by: NMatt Chen <matt.chen@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Support a new version of the beacon template command. This replaces v8
of the command, which was missing the rate code.  Also, export rate
decision logic to a separate function.
Signed-off-by: NHaim Dreyfuss <haim.dreyfuss@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

When an RX block-ack session times out, the firmware, which offloads
RX reordering but not the BA session negotiation, stops the session
but doesn't send a DELBA.  This causes the the session to remain
active in the remote device, so no more BA sessions will be
established, causing a severe throughput degradation due to the lack
of aggregation.

Use the new ieee80211_rx_ba_timer_expired API when the ba session timer
expires, since this will tear down the ba session and also send a delba.

The previous API used is intended for drivers that offload the
addba/delba negotiation, but not the rx reordering, while our driver
does the opposite.

This patch depends on "mac80211: add api to start ba session timer
expired flow".
Signed-off-by: NNaftali Goldstein <naftali.goldstein@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

In case there is no value received from BIOS
for cTDP budget, the default should be 2000 mWatt.
Signed-off-by: NChaya Rachel Ivgi <chaya.rachel.ivgi@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Getting the NVM data in a000 devices should be shared
across operation mode.
Signed-off-by: NShaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

CT-kill is a thermal-based "RF-kill", which disables the NIC
completely if the temperature gets too high, in order to avoid damage.

Add a debugfs entry to simulate high temperatures, in order to test
CT-kill flows in the driver without having to physically heat the
device up.
Signed-off-by: NChaya Rachel Ivgi <chaya.rachel.ivgi@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Declare thermal_cooling_device_ops structure as const as it is only passed
as an argument to the function thermal_cooling_device_register and this
argument is of type const. So, declare the structure as const.
Signed-off-by: NBhumika Goyal <bhumirks@gmail.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

On devices starting from 8000 series, the host can no longer toggle
the LED through the CSR_LED_REG register, but must do it via the
firmware instead. Add support for this. Note that this means that
the LED cannot be turned on while the firmware is off, so using an
arbitrary LED trigger may not work as expected.

Fixes: 503ab8c5 ("iwlwifi: Add 8000 HW family support")
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

If the module parameter is set to disable the LED, we leave the
initialization routine before setting the LEDS_INIT_COMPLETE
status bit. Therefore, there's no need to check the parameter
again on exit, just the status check is sufficient.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

When we start an Rx A-MPDU session, we first get the AddBA
request, then we send an ADD_STA command to the firmware
that will reply with a BAID which is a hardware resource
that tracks the BA session.
This BAID will appear on each and every frame that we get
from the firwmare until the A-MPDU session is torn down.
In the Rx path, we look at this BAID to manage the
reordering buffer.

This flow is inherently racy since the hardware will start
to put the BAID in the frames it receives even if the
firmware hasn't sent the response to the ADD_STA command.
This basically means that the driver can get frames with
a valid BAID that it doesn't know yet.
When that happens, the driver used to WARN.
Fix this by simply not WARN in this case. When the driver
will know abou the BAID, it will initialise the relevant
states and the next frame with a valid BAID will refresh
them.

Fixes: b915c101 ("iwlwifi: mvm: add reorder buffer per queue")
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

In AP mode, if a station is removed just as it is adding a new stream,
the queue in question will remain stopped and no more TX will happen
in this queue, leading to connection failures and other problems.

This is because under DQA, when tx is deferred because a queue needs
to be allocated, the mac queue for that TID is stopped until the new
stream is added.  If at this point the station that this stream
belongs to is removed, all the deferred tx frames are purged, but the
mac queue is not restarted. As a result, all following tx on this
queue will not be transmitted.

Fix this by starting the relevant mac queues when the deferred tx
frames are purged.

Fixes: 24afba76 ("iwlwifi: mvm: support bss dynamic alloc/dealloc of queues")
Signed-off-by: NAvraham Stern <avraham.stern@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

We should free 'wgds.pointer' here as done a few lines above in another
error handling path.
It was allocated within 'acpi_evaluate_object()'.

Fixes: c52030a01ccc ("iwlwifi: mvm: add GEO_TX_POWER_LIMIT cmd for geographic tx power table")
Signed-off-by: NChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

We already have a such a pointer.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

All the firmware versions the driver supports enable DQA, and thus
the only way to get non-DQA mode is to modify the source. Remove
this mode to simplify the code.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The iwl_mvm_add_bcast_sta() and the iwl_mvm_rm_bcast_sta() functions
are only called in P2P flows.  Add _p2p_ to the function names to make
this explicit.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

There's no need to spell out the cases when we can just
use ieee80211_is_bufferable_mmpdu().
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>