* don't load firmware that won't exist for 7260
* fix RCU splat

Move constants to the right of binary operators.

Generated by: scripts/coccinelle/misc/compare_const_fl.cocci

type=cleanup
Signed-off-by: NFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: NJulia Lawall <julia.lawall@lip6.fr>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

RFC4862 states that "In all cases, a node MUST NOT respond to
a Neighbor Solicitation for a tentative address".
Currently the driver configures the NS offload and does not wait
for address to become permanent, thus violating the RFC.
Just removing the address from the address list is not good enough
for all cases, since the NS messages are needed for the duplicate
address detection and should not be discarded.

For d0i3 disable NS offload. Put tentative address in the address
list so the NS packet will not be filtered out by ucode.
For D3 the platform will not wake from NS packets - so enable
NS offload while removing the tentative address from the list.

Given that now NS offload might be disabled, and that the ucode
uses the IP data for other puroposes (L3 filtering) add two
independent flags indicating if IPv4\IPv6 data is valid.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Today, in order to configure fw in usniffer mode, the ucode
must have the corresponding tlv, which is revealed to the driver
while parsing the ucode.

Expose the mode of the usniffer to other utilities in the driver
(other than the ucode parser) by passing back a pointer to the value.
This can be very useful for allowing configuring the fw dbg data
using an external configuration file, because this configuration
depends on the fw usniffer mode.
Signed-off-by: NGolan Ben-Ami <golan.ben.ami@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Properly protect the RCU dereference in iwl_mvm_get_key_sta_id() when
coming from iwl_mvm_update_tkip_key() which cannot hold the mvm->mutex
by moving the call into the RCU critical section.
Modify the check to use rcu_dereference_check() to permit this.

Fixes: 9513c5e1 ("iwlwifi: mvm: Avoid dereferencing sta if it was already flushed")
Reported-by: NLaura Abbott <labbott@redhat.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The 7260 devices aren't going to be updated for completely new
firmware versions any more (only bugfixes), and haven't been
since API version 17. Encode that in the data structures to
avoid trying to load FW images that will never exist.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The d0i3_mode variable is used to distinguish between transports that
handle d0i3 entry during suspend by themselves (i.e. the slave
transports) and those which rely on the op_mode layer to do it.  The
reason why the former do it by themselves is that they need to
transition from d0i3 in runtime_suspend into d0i3 in system-wide
suspend and this transition needs to happen before the op_mode's
suspend flow is called.

The wowlan_d0i3 element is also a bit confusing, because it just
reflects the wowlan->any value for the trans to understand.  This is a
bit unclear in the code and not generic enough for future use.

To make it clearer and to generalize the platform power mode settings,
introduce two variables to indicate the platform power management
modes used by the transport.

Additionally, in order not to take too big a step in one patch, treat
this new variables semantically in the same way as the old d0i3_mode
element, introducing a iwl_mvm_enter_d0i3_on_suspend() function to
help with that.

This commit also adds the foundation for a new concept where the
firmware configuration state (i.e. D0, D3 or D0i3) is abstracted from
the platform PM mode we are in (i.e. runtime suspend or system-wide
suspend).
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Remove the vif parameter of iwl_mvm_configure_bcast_filter()
as it's not being used.
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

d0i3 commands are not supported in the init image, so take
a reference to ensure we don't enter d0i3 during init image,
and additional checks to prevent d0i3 commands when no
fw image is loaded.

Add a few WARN_ON_ONCE to the d0i3 enter/exit commands
to ensure we send d0i3 commands only when the normal
ucode is loaded.
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When we have holes in the BA window, there might be frames
that have been ACKed between the read and the right
pointers. This means that these frames won't be scheduled
again by the SCD and the firwmare won't see them.
This invalidates the number of frames we tell the firmware
to send. When we detect this case, tell mac80211 to close
the SP and to send an EOSP so that the firmware can be in
sync.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This pull request got a bit bigger than I wanted, due to
needing to reshuffle and fix some bugs. I merged mac80211
to get the right base for some of these changes.

 * new mac80211 API for upcoming driver changes: EOSP handling,
   key iteration
 * scan abort changes allowing to cancel an ongoing scan
 * VHT IBSS 80+80 MHz support
 * re-enable full AP client state tracking after fixes
 * various small fixes (that weren't relevant for mac80211)
 * various cleanups

Host commands now have a group id, express this in printed messages.
Signed-off-by: NSharon Dvir <sharon.dvir@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This function got too big to be inlined. Uninline it.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

We send an ADD_STA to instruct the firmware to release
frames despite the peer being in PS.
Since the ADD_STA command and the Tx frame that comes
immediately afterwards can be reordered by the DMA engine,
we need to block the Tx queues until the firmware replies
with the ADD_STA response.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This allows the op_mode to request from the transport to
call a callback when an ASYNC commands is completed by
the firmware. The same callback will be called for all the
commands. Pass the command whose response triggers the
callback as a parameter to the callback itself.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

In certain flows (see next patches), the op_mode may need to
block the Tx queues for a short period. Provide an API for
that. The transport is in charge of counting the number of
times the queues are blocked since the op_mode may block the
queues several times in a row before unblocking them.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

commit 9a4c830007817e ("iwlwifi: mvm: refactor d3 key
update functions") refactored some code into
iwl_mvm_wowlan_config_key_params() function, but the
return value was never checked, and not all the function
flows returned valid values. fix it.

Fixes: ac8ef0ce ("iwlwifi: mvm: refactor d3 key update functions")
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

iwl_mvm_restart_cleanup() calls ieee80211_remain_on_channel_expired()
on cleanup, but it doesn't clean the actual roc time
events, resulting in failure of further ROC attempts.

Refactor iwl_mvm_stop_roc() a bit, and add a new function
to only cleanup the roc time events (without sending further
commands).
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Smatch prints a static checker warning here:

    drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c:386 iwl_dump_prph()
    warn: curly braces intended?

Curly braces are NOT intended, the extra tab was added by mistake in
commit 1a616dd2 ('iwlwifi: dump prph registers in a common place
for all transports').

type=cleanup
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

If the transport supports it, advertise NETIF_F_SG to mac80211 to
be able to use frag SKBs. This will already improve performance by
allowing software GSO to be used.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

If the transport supports it, advertise NETIF_F_SG to mac80211 to
be able to use frag SKBs. This will already improve performance by
allowing software GSO to be used.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Klocwork pointed these out. There is a theoretical possibility
that rate->index might be set to IWL_RATE_INVALID (15).
This could trigger an out of bounds access on ht_vht_rates or
legacy_rates arrays. Fix it by adding some checks.
Signed-off-by: NEyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Change scan configuration (dwell time, suspend time etc.) according
to traffic conditions. This is useful for scans that are managed by
the FW (e.g. scheduled scan).
Signed-off-by: NAvraham Stern <avraham.stern@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When sending the first ADD_STA HCMD for a STA, the %add_modify
field indicates an addition of a STA and not a modification
of one. In such a case, all fields of the HCMD are used to
initialize the corresponding fields in the FW, regardless of
what bits are set in %modify_mask.

Set the %tid_disable_tx field to mvm_sta->tid_disable_agg in
iwl_mvm_sta_send_to_fw(). If the STA is only updated this will
have no effect, but if it is added - it will make sure the
STA starts with the correct queues - if any - configured as
non-aggregated by default (until told otherwise).
Signed-off-by: NLiad Kaufman <liad.kaufman@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Extend the configurable option of setting initial rate to RSSI based.
Make the initial rate to be set to VHT/HT SISO or legacy depending on
the AP capabilities.
Signed-off-by: NGregory Greenman <gregory.greenman@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

In case of HW ROC, when the driver reports that the ROC expired,
it is not sufficient to purge the ROCs based on the remaining
time, as it possible that the device finished the ROC session
before the actual requested duration.

To handle such cases, in case of ROC expired notification from
the driver, complete all the ROCs which are marked with hw_begun,
regardless of the remaining duration.
Signed-off-by: NIlan Peer <ilan.peer@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

There is no reason to keep a reference when the interface is down,
since we are not really doing anything.  The reference is only needed
when the mac80211 start op (or a hw restart) is running, to prevent
going into runtime or system supend in the meantime.  This will allow
us to support runtime PM when the interface is down (in another
patch).
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

If a packet is received from netlink with the frequency value set it is
checked against the current radio's frequency and discarded if different.
The frequency is also checked against data2->tmp_chan to support the "hw"
off-channel/scan case.
Signed-off-by: NAdam Welle <arwelle@cert.org>
[allow both simultaneously, add locking]
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

If the rate control algorithm messed up then the txrate pointer
here could be NULL - WARN and drop the packet from monitoring.
Signed-off-by: NAmit Khatri <amit.khatri@samsung.com>
Signed-off-by: NRahul Jain <rahul.jain@samsung.com>
[rewrite commit message, add warning]
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

When cancelling, you can cancel "any" (first in list) mgmt-tx
or remain-on-channel operation by using the value 0 for the
cookie along with the *opposite* operation, i.e.
 * cancel the first mgmt-tx by cancelling roc with 0 cookie
 * cancel the first roc by cancelling mgmt-tx with 0 cookie

This isn't really that bad since userspace should only pass
cookies that we gave it, but could lead to hard-to-debug
issues so better prevent it and reject zero values since we
never hand those out.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Instead of using pointers, use sequentially assigned cookies.
This is easier to understand while debugging and also avoids
problems when the pointer is reused for the next allocation.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

VHT can be used with IBSS without needing any additional changes in
mac80211_hwsim, so start claiming support for this to increase test
coverage.
Signed-off-by: NJouni Malinen <j@w1.fi>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Previously, this was done only for Beacon frames, but similar timestamp
update is needed for Probe Response frames to make these more accurately
match the real IEEE 802.11 behavior. Previously, all zeros timestamp was
sent in Probe Response frames.
Signed-off-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

While it was possible to create an IBSS with 80+80 MHz channel, joining
such an IBSS resulted in falling back to 20 MHz channel with VHT
disabled due to a missing switch case for 80+80.
Signed-off-by: NJouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The same piece of code appears at two places. Make a function from it.
Signed-off-by: NMichal Sojka <sojkam1@fel.cvut.cz>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Jouni found a bug in the remain-on-channel logic: when a short item
is queued, a long item is combined with it extending the original
one, and then the long item is deleted, the timeout doesn't go back
to the short one, and the short item ends up taking a long time. In
this case, this showed as blocking scan when running two test cases
back to back - the scan from the second was delayed even though all
the remain-on-channel items should long have been gone.

Fixing this with the current data structures turns out to be a bit
complicated, we just remove the long item from the dependents list
right now and don't recalculate the timeouts.

There's a somewhat similar bug where we delete the short item and
all the dependents go with it; to fix this we'd have to move them
from the dependents to the real list.

Instead of trying to do that, rewrite the code to not have all this
complexity in the data structures: use a single list and allow more
than one entry in it being marked as started. This makes the code a
bit more complex, the worker needs to understand that it might need
to just remove one of the started items, while keeping the device
off-channel, but that's not more complicated than the nested data
structures.

This then fixes both issues described, and makes it easier to also
limit the overall off-channel time when combining.

TODO: as before, with hardware remain-on-channel, deleting an item
after combining results in cancelling them all - we can keep track
of the time elapsed and only cancel after that to fix this.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Typically drivers that implement hardware remain-on-channel will
have to wait for scheduling constraints, so make hwsim also wait
a little bit (only 20ms) before actually starting the operation.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Since the cookie is assigned inside ieee80211_make_ack_skb()
now, we no longer need to return the ack_skb as the cookie
and can simplify the function's return and the callers. Also
rename it to ieee80211_attach_ack_skb() to more accurately
reflect its purpose.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

This is quite a bit of code that logically depends here since
it has to deal with all the remain-on-channel logic.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

If a mgmt-tx operation is aborted before it runs, the wrong
cookie is reported back to userspace, and the ack_skb gets
leaked since the frame is freed directly instead of freeing
it using ieee80211_free_txskb(). Fix that.

Fixes: 3b79af97 ("mac80211: stop using pointers as userspace cookies")
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>