Move the TX PN assignment (for CCMP only) to the driver. This prepares
the driver for future DSO (driver segmentation offload) where it will
split an SKB into multiple MPDUs by itself.

For TDLS, split out the CCMP TX command handling so that it won't get
a PN assigned, the firmware assigns the PN in that case.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

TCP software implementation on the host requires extensive computing
power.  Offloading even some of the TCP/IP stack to the NIC might save
a significant overhead. In order to enable this feature on our hw,
we need to configure it first. Once done, we mark this capability,
to be advertised later to the OS via ieee80211_register_hw.
The driver Rx indications for TCP Checksum is integrated within the
standard Rx status. The driver responds to those indications as follows:
If the frame was tested by hw and checksum ok report CHECKSUM_UNNECESSARY.
Otherwise, report CHECKSUM_NONE.
Signed-off-by: NAvri Altman <avri.altman@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This reverts commit 088070a2.

When working in d0i3_on_idle mode, we explicitly go out
of d0i3 on resume (so other potential commands could
be sent).

However, D0I3_DEFER_WAKEUP is currently cleared on
resume complete (which happens only later on), causing
d0i3 exit to timeout.

Since mac80211 was modified to accept incoming frames
once drv_resume was called, we can safely revert this
patch, and handle the pending work on iwl_mvm_resume().
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

As we're running out of hardware capability flags pretty quickly,
convert them to use the regular test_bit() style unsigned long
bitmaps.

This introduces a number of helper functions/macros to set and to
test the bits, along with new debugfs code.

The occurrences of an explicit __clear_bit() are intentional, the
drivers were never supposed to change their supported bits on the
fly. We should investigate changing this to be a per-frame flag.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

After the new ciphers CCMP-256 and GCMP-128/256 were implemented,
wpa_supplicant could start negotiating them and use the software
implementation. This, however, breaks D3 behaviour in the driver
since it means that WoWLAN will not be possible.

To avoid breaking that feature, advertise only ciphers that the
hardware supports.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Currently, loading the firmware fails when it has higher API or CAPA
bits than the driver supports. That's an issue with integration.

At the same time, actually using api[0] and capa[0] will become
confusing when we also have api[1] and capa[1], and it's almost
certain that we'll mix up the bits and use the bits for api[1] with
api[0] by accident.

Avoid all this by translating the API/CAPA bits to the regular kernel
test_bit() format, and also providing wrapper functions. Also use the
__bitwise__ facility of sparse to check that we're testing the right
one.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Since the firmware is responsible for duration calculation, the
driver can easily support fast-xmit.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The naming convention is to always have the flags prefixed with
IEEE80211_HW_ so they're 'namespaced', make this flag follow it.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

If a HW recovery was started but not completed since all interfaces went
down, make sure to cleanup all interfaces before clearing the HW_RESTART
flag.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

BlockAck sessions can have events that are interesting to
debug. When we send or receive a BAR, it is may indicate
that something bad is happening. Even more so when mac80211
tells us that a frame timed out in the reodering buffer.
Add a few triggers for BlockAck session debugging.
Allow per-TID debugging.
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

For UMAC, we were not treating a race condition that happens in the
scan flows, because it was not using the same state flags.  Now that
UMAC and LMAC scans use the same state flags, we can also handle the
race conditions for UMAC.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The regular and scheduled scan functions are very similar, so they can
be combined into one.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

We can only have one scan of each type running at the same time, so we
can remove one attribute in the UID information we save.  We had array
index, UID and type, but only UID (== array_index) and type are
necessary.  Refactor the code to use this simplified array.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

It is not necessary to stop regular scans when going out of idle
state.  Previously, we were doing so for LMAC scans because the
iwl_mvm_scan_offload_stop() function was stopping both kinds of scans.
Now that we have more granularity, we can skip it.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The iwl_mvm_scan_offload_stop() function is used to stop LMAC regular
scan, stop LMAC scheduled scan and stop UMAC scheduled scans (but not
UMAC regular scans), making it very difficult to read.

Reorganize the scan stopping functions by creating separate functions
to stop regular and scheduled scans, separating the LMAC stopping part
of the code from the rest and renaming the offload_stop function to
iwl_mvm_lmac_scan_stop().
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

According to the nl80211 documentation, we can neither advertise
scheduled scan nor netdetect address randomisation. However, all
the products that currently require this don't have a need for
the full randomisation.

Therefore, advertise the feature anyway which results in host-
based randomisation, done whenever the system suspends. This is
sufficient for the platforms currently requiring this feature.

If we ever extend this in the future to do full randomisation in
the firmware, then certainly this will still be sufficient for
the current requirements, so it doesn't make a lot of sense to
split the feature bits.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Reviewed-by: NLuciano Coelho <luciano.coelho@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This removes the use of the two deprecated calls to the
macro PTR_RET in iwl_mvm_get_regdomain and replaces them
both to PTR_ERR_OR_ZERO.
Signed-off-by: NNicholas Krause <xerofoify@gmail.com>
[Commit message editing]
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

commit b112889c ("iwlwifi: mvm: add Aux ROC request/response flow")
added aux ROC flow in addition to the existing ROC flow. While doing
it, it moved the ROC reference release to a common work item, which
is being called for both the ROC and aux ROC flows.

This resulted in invalid reference accounting, as no reference was
taken in case of aux ROC, while a reference was released on completion.

Fix it by adding a reference for the aux ROC as well, and release
only the relevant references on completion (according to the set bits).

While at it, convert cancel_work_sync() to flush_work(), in order
to make sure the references are being cleaned properly.

Fixes: b112889c ("iwlwifi: mvm: add Aux ROC request/response flow")
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

A few triggers have status = MLME_SUCCESS and they are still
interesting. E.g. if we want to collect data upon deauth,
the status will be MLME_SUCCESS. Fix that.

Fixes: d42f5350 ("iwlwifi: mvm: add trigger for firmware dump upon MLME failures")
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When a firmware restart is done, don't try to reprogram the keys to new
slots but rather just keep the old key index, while skipping keys that
weren't programmed before.

Not only does this restore the state more faithfully, but it will also
allow using the HW key index for internal purposes as an array index.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Reviewed-by: NLuciano Coelho <luciano.coelho@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Usually during HW recovery the state of all active interfaces is cleaned
up during drv_start(). There's a special case where a HW restart is
requested when an interface is going down. In this case the iface-iterator
won't see this interface and we won't clean it. This has bad consequences
once the interface is legitimately brought up again.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Instead of repeating the same code in 4 different places, combine the
comparisons into a new function.  Additionally, this change fixes UMAC
scans where the RRM IEs were not taken into consideration when
calculating the IE length.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

We don't support -9.ucode so, all the released firmwares
support scheduled scan properly.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Net-detect scans were using the same type as sched scan, which was
causing the driver to return -EBUSY and prevent the system from
suspending if there was an ongoing scheduled scan.  To avoid this, add
a new type for net-detect and don't stop anything when it is
requested, so that the existing scheduled scan will be resumed when
the system wakes up.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Move all the scan code that was in mac80211.c to scan.c where it
belongs, leaving only the parts that are specific to mac80211 ops.

Change some function definitions slightly to improve consistency.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

All scans are using the unified APIs now, so using "unified" in the
symbols is useless and just make them much longer and the main
difference between scans now is LMAC vs. UMAC.  Remove "unified" from
all relevant symbols.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Instead of hardcoding the differences between UMAC scans and LMAC
scans (which in this case is the number of simultaneous scans that can
run), introduce a max_scans variable and stop scans of the other type
(i.e. stop sched scan if regular scan is being attempted and
vice-versa) if the number of running scans reached the maximum.

Add a function that checks if the maximum number of scans was reached
and stops the appropriate scan to make room for the new scan.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

If a new scan cannot be run for some reason, we shouldn't cancel other
ongoing scans.  Move the checks to before the code that cancels other
scans.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Now that we have separate flags for stopping scans, we don't need to
wait for the scan stopped work to complete before starting the new
scan.  Previously we needed it because we had no way of distinguishing
the scan that was being stopped from the scan that was currently
running.  With the new flags there won't be any confusions and we are
able to handle the stop for the correct type of scan.

Thus we can remove the iwl_mvm_cancel_scan_wait_notif() function.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

LMAC scans cannot handle more than one scan at a time, but UMAC scans
can.  To avoid confusion we should combine the states of these two
types of scans.  To do so, we need to support mutliple scans at the
same time for UMAC.

This commit changes the scan_status element from a single value to a
bitmask of running scan types for LMAC.  Later, we will modify UMAC
scans to use the same state bitmask.

Additionally, add stopping scan flags for scheduled and regular scans.
This makes it easier to differentiate and handle stop requests
triggered by the driver and spontaneous stops generated by the
firmware.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When user space requests mac80211 to transmit a frame off
channel, mac80211 notifies the driver, and the driver requests
a time event from the ucode, and then transmits the frame.
When the driver requests a time event, it can specify what is the allowed
max delay for starting the time event.

When the max delay is too big, this can cause a timeout in the user space,
that is waiting for the frame to be transmitted.

Currently the max delay is extremely long.

Reduce the max delay for the AUX ROC time event that is sent to the ucode.
Signed-off-by: NMatti Gottlieb <matti.gottlieb@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

During firmware restart, the quota command isn't calculated multiple
times, but after the firmware restart it has to be sent, so force it.
Otherwise the firmware crashes.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The firmware doesn't relate the scan to a vif. The scan is
run by a separate entity called auxiliary MAC (aka AUX MAC).
This AUX MAC needs to get Tx power limitations that are
not applied on a specific vif, but on the device as a whole.

This can be implemented by using the minimum of all the
values set by the user for all the MACs. But then we need
to ignore the limitations that come from the AP or
regulatory for a specific vif: a specific vif might have
regulatory limitations because of the channel is works on.
This limit is irrelevant for the AUX MAC.
Use the new API from mac80211: the user_power_level in
bss_conf to achieve this.

Firmware -13.ucode has already moved to this API.

Change-Id: Ifba83660f378e91b93bd46d29fe8ba35a7c168a4
Signed-off-by: NAvri Altman <avri.altman@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The current code has a lot of duplicates of printing into a buffer
(while having to make sure it's NUL-filled and -terminated) and
then passing that to the debug trigger collection.

Since that's error-prone, instead make the debug trigger collection
function take a format string and format arguments (with compiler
validity checking) and handle the buffer internally.

This makes one behavioural change -- instead of sending the whole
buffer to userspace (clearing is needed to not leak stack data) it
just passes the actual string (including NUL-terminator.)
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

If ucode_loaded isn't true the function returns the 'ret' variable
without having assigned a value properly. Fix that.
Reported-by: NHaim Dreyfuss <haim.dreyfuss@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This will allow to catch failures in MLME and get the
firmware data when this happens.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The str/len arguments to iwl_fw_dbg_trigger_simple_stop() aren't used,
and for a simple trigger don't really need to be used as the trigger
code itself encodes the reason, so remove them.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Sending multiple action frames off channel, one after the other can create
a race that will result in a timeout:

1. Start sending action frame off channel.
2. Once the frame is sent or the time event is over, the flow will
eventually call ieee80211_start_next_roc to start the next roc frame &
iwl_mvm_roc_finished schedules to schedule a work to flush the queue.
3. Start sending new roc frame and write it to the queue before the
flush work has started.
4. The work is called and it flushes the new packet that was placed on the
on the queue so the packet is lost.

This causes the frame to be removed & not sent, that causes a timeout in
userspace.

Flush the work queue that flushes the roc/off channel queue before starting
to send a new frame off channel, in order to avoid a race between the new
frame that is transmitted off channel & the flushing of the queue.
Signed-off-by: NMatti Gottlieb <matti.gottlieb@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Currently the last found MCC is reconfigured only in the recovery flow.
But it should always be used when available, for the ifdown/up or
RF-Kill/CT-Kill scenarios.
While at it, fix a couple of bugs in the init-from-last-MCC flow. Return
an error value when a current MCC is not found. Pass on the regdomain to
cfg80211 only if it was changed and don't ignore the return value from
the cfg80211-setter function.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

In the reset flow, the driver cancels ongoing scan and sends scan
complete notification to mac80211. However it does not clean its UID.
Add cleaning scan UID for the ongoing scan. Loop over all other UIDs
to make sure there's nothing left there and warn if any is found.
Signed-off-by: NAlexander Bondar <alexander.bondar@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>