This is a static analysis fix.  The warning is:

	drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c:912 iwl_mvm_fw_dbg_collect()
	warn: integer overflows 'sizeof(*desc) + len'

I guess this code is supposed to take a NUL character, but if we write
zero bytes then it tries to write -1 characters and crashes.

Fixes: c91b865c ("iwlwifi: mvm: support description for user triggered fw dbg collection")
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The value returned from iwl_mvm_send_cmd_pdu() in this function is not
used and always returns an error (which is the whole point of the
call).  Tag the ret variable with __maybe_unused to avoid this compile
warning when W=1 is used:

/home/luca/iwlwifi/stack-dev/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c: In function ‘iwl_dbgfs_fw_restart_write’:
/home/luca/iwlwifi/stack-dev/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c:875:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
  int ret;
      ^
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

In iwl_dbgfs_mem_read(), the len variable may become negative and is
compared to < 0 (an error case).  Comparing size_t (which is unsigned)
to < 0 causes a warning on certain platforms (like i386):

drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c:1561:5-8: WARNING: Unsigned expression compared with zero: len < 0

To prevent that, use ssize_t for len instead.

Fixes: commit 2b55f43f ("iwlwifi: mvm: Add mem debugfs entry")
Reported-by: Nkbuild test robot <fengguang.wu@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

In order to access cached/paged memory, there are a couple of firmware
commands (one for UMAC and one for LMAC) that let the host access memory
and registers indirectly. Since this is done by the firmware on behalf
of the host, even if memory is paged out or cached, the host will
retrieve the memory as the firmware sees it (paged out memory will get
paged in).

Export this mechanism via a debugfs entry for both read and write
access.

WARNING: This mechanism has no protections at all. Invalid addresses may
crash or hang the firmware. Writing to arbitrary memory also comes with
no guarantees.
Signed-off-by: NIdo Yariv <idox.yariv@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

For automatic testing packet injection can be useful.
Support injection through debugfs.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

"max_amsdu_len" isn't set if kstrtouint() fails.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

When a data packet is received, we need to make sure that we stay
awake until it can be processed and wait a while before trying to
enter runtime_suspend os system_suspend again.  To do so, add a new
reference type for RX data and take the reference when sending the
packet to mac80211.  We only do this for data packets, all the other
RX packets sent by the firmware (e.g. notifications) are not a reason
to prevent suspend.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

If a host command was queued while in runtime suspend, it would go out
before the D0I3_END_CMD was sent.  Sometimes it works, but sometimes
it fails, and it is obviously the wrong thing to do.

To fix this, have the opmode take a reference before sending a SYNC
command and make the pcie trans wait for the runtime state to become
active before actually queueing the command.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Improve current RSS configuration:
 * Use netdev_rss_key instead of keeping a local copy.
 * Configure also UDP hashing to have UDP traffic spread across queues.
 * Do not direct RSS traffic to our fallback queue.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

API version lower than 16 is not supported anymore - don't
load older ucode.
Remove code handling older versions.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Add debugfs entries to get the ctdp budget average
and to stop ctdp.
Signed-off-by: NChaya Rachel Ivgi <chaya.rachel.ivgi@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

in order to be able to tune the size of the desired A-MSDU
based on link condition, add a knob to modify the length
of the A-MSDU.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The initialization and copying of the RSS secret key
should not use ARRAY_SIZE as we need to initialize a
dword array, and not a byte array.
Fix also the hook maximum write size to allow writing
a longer table - up to full indirection table size.

Fixes: 43413a97("iwlwifi: mvm: support rss queues configuration command")
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When in AP mode we need to filter in beacons from other APs to update HT
operation mode. As a power optimization the beacons are filtered out when
there are no associated stations. As a result, when there are no
associated stations, we will not update the HT operation mode until a
station connects.
Add a debugfs parameter that allows to disable this optimization.
Signed-off-by: NAndrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

9000 series supports multi-queue rx. The hardware needs
to be configured with the hash functions to perform and
indirection table that maps hash results to the relevant
CPUs\queues.
Support this configuration.
Add debugfs hook to configure the indirection table in
order to enable performance analysis. The configuration
is stateless, receives a partial or full pattern and sends
the command to the firmware.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The driver should support also negative temperatures.
So there is a need to separate between the return value and
temperature in order to be able to distinguish between
a negative temperature and error value.
Signed-off-by: NChaya Rachel Ivgi <chaya.rachel.ivgi@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Using kstrtouint() with a signed int isn't really right,
use kstrotoint() instead.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Add to the user triggered fw debug collection support for describing
the reason of the trigger.
This could be useful for identifying a dump by a unique id, passed as
a description.
Signed-off-by: NGolan Ben-Ami <golan.ben.ami@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

ilw@linux.intel.com is not available anymore.
linuxwifi@intel.com should be used instead.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

d0i3 commands are not supported in the init image, so take
a reference to ensure we don't enter d0i3 during init image,
and additional checks to prevent d0i3 commands when no
fw image is loaded.

Add a few WARN_ON_ONCE to the d0i3 enter/exit commands
to ensure we send d0i3 commands only when the normal
ucode is loaded.
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Add ability to set the continuous recording mode of the FW, while
the FW debug data is configured to be stored on the NIC.
This could be useful for storing large segments of FW usniffer
debug data on the host, while having small store space on the NIC.
The host receives the usniffer data through the regular RX path, and
the data can get extracted using trace-cmd.
Signed-off-by: NGolan Ben-Ami <golan.ben.ami@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The fw debug functionality is big enough to warrant
a separate file. Move existing related functions to the new file.
Signed-off-by: NGolan Ben-Ami <golan.ben.ami@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This was an old workaround for solving latency issues with
certain Miracast adapters like ActionTec. However this isn't
needed anymore and furthermore it hurts throughput in other
use cases.
Signed-off-by: NEyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

As part of the bt_notif file add fields that are currently
not represented
Signed-off-by: NMoshe Harel <moshe.harel@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Add mplut and sync2sco and corunning to debugfs.
Signed-off-by: NMoshe Harel <moshe.harel@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Part of reorganising wireless drivers directory and Kconfig.
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Instead of only allowing the caller to decide whether the CMD_ASYNC
flag is set, let it pass the entire flags bitmask.  This allows more
flexibility and will be needed when we call this function in the
suspend flow (where other flags are needed).
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The only NVM section not captured in debugfs.
Signed-off-by: NMoshe Harel <moshe.harel@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

ECHO_CMD is a simple command that can be sent to the
firmware just to check that it is alive.
This command is useful for debug purpose, provide a debugfs
hook to send it.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>

This debugfs entry was implemented just as a proof-of-concept before
the full support for netdetect via cfg80211/mac80211 was implemented.
Now that we have a proper way to enable netdetect from userspace, this
entry is redundant and should be removed to avoid unnecessary
maintenance work.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>

My static checker complains that we don't check for underflows in
iwl_dbgfs_fw_dbg_conf_write().  This is harmless because we have a
sanity check in iwl_mvm_start_fw_dbg_conf(), but we may as well make
this unsigned and silence the underflow warning.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

There is no need to use hex_dump_to_buffer() in the cases like this:

	hexdump_to_buffer(buf, len, 16, 1, outbuf, outlen, false);	/* len <= 16 */
	sprintf("%s\n", outbuf);

since it maybe easily converted to simple:

	sprintf("%*ph\n", len, buf);

Note: it seems in one case the output is groupped by 2 bytes and looks like a
typo. Thus, patch changes that to plain byte stream.
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Change the FW debug trigger tlv to include a monitor only
option. Setting this option to true will cause fw dump triggers
to only collect monitor data and skip other dumps such as
SMEM, SRAM, CSR, PRPH, etc.
This option is used when accessing the different parts of the
firmware memory is not wanted and can cause unwanted behavior
like when debugging TX latency.
Signed-off-by: NOren Givon <oren.givon@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Currently, loading the firmware fails when it has higher API or CAPA
bits than the driver supports. That's an issue with integration.

At the same time, actually using api[0] and capa[0] will become
confusing when we also have api[1] and capa[1], and it's almost
certain that we'll mix up the bits and use the bits for api[1] with
api[0] by accident.

Avoid all this by translating the API/CAPA bits to the regular kernel
test_bit() format, and also providing wrapper functions. Also use the
__bitwise__ facility of sparse to check that we're testing the right
one.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

commit b112889c ("iwlwifi: mvm: add Aux ROC request/response flow")
added aux ROC flow in addition to the existing ROC flow. While doing
it, it moved the ROC reference release to a common work item, which
is being called for both the ROC and aux ROC flows.

This resulted in invalid reference accounting, as no reference was
taken in case of aux ROC, while a reference was released on completion.

Fix it by adding a reference for the aux ROC as well, and release
only the relevant references on completion (according to the set bits).

While at it, convert cancel_work_sync() to flush_work(), in order
to make sure the references are being cleaned properly.

Fixes: b112889c ("iwlwifi: mvm: add Aux ROC request/response flow")
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Our testers need to know the number of scans performed while in
net-detect mode before the device wakes up.  The firmware already
passes this information to the driver, so we can save it and report it
in a debugfs entry.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

There is no need to implement the enable_scan_iteration_notif handling
explicitly and there's no reason not to export the current value.  So
use debugfs_create_bool() instead.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The firmware was not using the new API, so we don't need to
differentiate between the different stages of this new API.
The main difference here is that most of the hard coded
values are not sent through the command anymore.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Now that the firmware dump can be triggered by events in
the code and not only the user or an firmware ASSERT, we
need a way to know why the firmware dump was triggered.
Add a section in the dump file for that.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>