The only other way to catch these would have been to monitor
the Tx deauth event, but we can send a deauth when we roam.
So it would have been tricky to make sure we capture the
connection losses only.
Define a separate trigger for the connection losses to make
it easier to catch them.
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This will allow to collect data when a time event
notifcation with a certain id and action is coming from
the firmware. This can be very useful to debug various
flows.
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The current code has a lot of duplicates of printing into a buffer
(while having to make sure it's NUL-filled and -terminated) and
then passing that to the debug trigger collection.

Since that's error-prone, instead make the debug trigger collection
function take a format string and format arguments (with compiler
validity checking) and handle the buffer internally.

This makes one behavioural change -- instead of sending the whole
buffer to userspace (clearing is needed to not leak stack data) it
just passes the actual string (including NUL-terminator.)
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Fix spelling error across the driver.
Modified only comments and prints.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

If ucode_loaded isn't true the function returns the 'ret' variable
without having assigned a value properly. Fix that.
Reported-by: NHaim Dreyfuss <haim.dreyfuss@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This will allow to catch failures in MLME and get the
firmware data when this happens.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The str/len arguments to iwl_fw_dbg_trigger_simple_stop() aren't used,
and for a simple trigger don't really need to be used as the trigger
code itself encodes the reason, so remove them.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Sending multiple action frames off channel, one after the other can create
a race that will result in a timeout:

1. Start sending action frame off channel.
2. Once the frame is sent or the time event is over, the flow will
eventually call ieee80211_start_next_roc to start the next roc frame &
iwl_mvm_roc_finished schedules to schedule a work to flush the queue.
3. Start sending new roc frame and write it to the queue before the
flush work has started.
4. The work is called and it flushes the new packet that was placed on the
on the queue so the packet is lost.

This causes the frame to be removed & not sent, that causes a timeout in
userspace.

Flush the work queue that flushes the roc/off channel queue before starting
to send a new frame off channel, in order to avoid a race between the new
frame that is transmitted off channel & the flushing of the queue.
Signed-off-by: NMatti Gottlieb <matti.gottlieb@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Currently the last found MCC is reconfigured only in the recovery flow.
But it should always be used when available, for the ifdown/up or
RF-Kill/CT-Kill scenarios.
While at it, fix a couple of bugs in the init-from-last-MCC flow. Return
an error value when a current MCC is not found. Pass on the regdomain to
cfg80211 only if it was changed and don't ignore the return value from
the cfg80211-setter function.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Our testers need to know the number of scans performed while in
net-detect mode before the device wakes up.  The firmware already
passes this information to the driver, so we can save it and report it
in a debugfs entry.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Minor cleanup and refactoring.
Signed-off-by: NEyal Shapira <eyalx.shapira@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

We will be able to add more events, such as MLME events and
others. The low level driver may be interested in knowing
about these events to dump firmware data upon failures, or
to change parameters in case connection attempts fail etc...
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Signed-off-by: NLiad Kaufman <liad.kaufman@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

In the reset flow, the driver cancels ongoing scan and sends scan
complete notification to mac80211. However it does not clean its UID.
Add cleaning scan UID for the ongoing scan. Loop over all other UIDs
to make sure there's nothing left there and warn if any is found.
Signed-off-by: NAlexander Bondar <alexander.bondar@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

There is a strong relationship between the NVM version and
the hardware step. Enforce that in the driver in case the
default NVM on the platform is the wrong one.
Signed-off-by: NEran Harary <eran.harary@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Sometimes we will want to configure the timeouts for the
Tx queues based on the vif type. Allow to do that using the
trigger mechanism.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

These early versions are no longer supported.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

There is no need to implement the enable_scan_iteration_notif handling
explicitly and there's no reason not to export the current value.  So
use debugfs_create_bool() instead.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Add support for delaying the start of a scheduled scan (or a WoWLAN
net-detect scan).
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

In nic restart flow we inform mac80211 that scan was aborted, but it was
based only on scan_status which is not set by UMAC scan. Fix that.
Signed-off-by: NDavid Spinadel <david.spinadel@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Reviewed-by: NLuciano Coelho <luciano.coelho@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The AP_START d0i3 reference was never removed if the AP started correctly.
This has the unpleasant side-effect of preventing D0i3 on Android if the
WiFi hotspot was ever started on the device.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The firmware frequently manages to trigger this, and there's
no known driver workaround, so stop warning.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

we unref IWL_MVM_REF_UCODE_DOWN on iwl_mvm_restart_complete().

Usually, the restart is initiated by iwl_mvm_nic_restart(),
which takes the reference before restarting the hw.

However, in D3 flow we might call ieee80211_restart_hw()
directly (in case of suspend error and on d3_test-resume),
which without taking the ref first. fix it.
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When the driver callback returns that it's out of space for new
stations, the mac80211 IBSS code still keeps the station so it
doesn't try to add it over and over again.

Since the rate scaling algorithm is separate in mac80211, it also
invokes the rate scaling algorithm for such stations. It doesn't
know that our rate scaling algorithm is tightly integrated with
the MVM code and relies on those data structures, and it cannot
as the abstraction doesn't allow for it.

This leads to crashes when the rate scaling algorithm tries to
use uninitialized data, notably the mvmsta->vif pointer.

Protect against this in the rate scaling algorithm. We cannot get
good rates with such peers anyway since the firmware cannot do
anything with them.

This should fix https://bugzilla.kernel.org/show_bug.cgi?id=93461

CC: <stable@vger.kernel.org>
Reported-by: NRichard Taylor <rjt-kernel@thegrindstone.me.uk>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This warning is misleading. In many cases, for example P2P ROC time
events, this will happen if the time event is aborted, for example
due to a higher priority time event. This is entirely normal and not
worth warning about.

In other cases, where we actually do act upon this, for example when
trying to connect and this fails, we should instead warn as part of
the disconnect operation.

Change the code to do that, i.e. make the warning a debug message,
and make it more prominent (an error) when we actually disconnect
because of it.

This also fixes confusion in the logs - the warning was mistaken for
something that needed investigation, while in most cases it's just
expected behaviour that occasionally some lower-priority time events
would not complete fully.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

In 8000 HW family B-step only, the ICCM is separate
from the SRAM. This adds the ICCM to the dump data
collected for FW debug.
Signed-off-by: NLiad Kaufman <liad.kaufman@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

There are transport that must buffer frames in the driver.
This means that we have frames that are not in the op_mode
and not visible to the firwmare. This causes issues when we
flush the queues: the op_mode flushes a queue, and the
firmware flushes all the frames that are *currently* on the
rings, but if the transport buffers frames, it can submit
these while we are flushing. This leads to a situation
where we still have frames on the queues after we flushed
them.
Preventing those buffered frame from getting into the
firmware is possible, but then, we have to run the Tx
response path on frames that didn't reach the firmware
which is not desirable.
The way I solve this here is to let these frames go to the
firmware, but make sure the firmware will not transmit them
(by setting the station as draining). The op_mode then needs
to wait until the transport itself is empty to be sure that
the queue is really empty.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

According to FW methodology, the capability bits should be the only ones
that change per-HW. The API bits should remain constant across different
HWs.
Currently this is not the case with multi-source LAR (API bit 9). Assign
a new capability bit to eventually replace the API bit. Until the API bit
can be deprecated, the driver will check either to enable multi-source
LAR.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

If, on a GO, the CSA time event fails to be scheduled, continue the
flow towards mac80211's state machine so it doesn't get stuck, but
report an error later on the post switch which will cause mac80211
to tear down the operation. This ensures nothing gets stuck due to
the scheduling failure.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The return value in iwl_mvm_get_wakeup_status() is a bit unclear in
that it's not obvious that we don't leak fw_status in some cases.
Use fw_status directly with ERR_PTR() and return only it, that way
the compiler has a chance of proving that it's uninitialized (if it
ever is due to new changes.)

Additionally, this removes a smatch warning since smatch couldn't
figure out that fw_status can't, in fact, leak here.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When IWLWIFI_DEBUGFS is not set, we should not unlock the mutex after
calling iwl_mvm_query_wakeup_reasons(), because this function unlocks
it already.  Move the goto out_iterate outside the #ifdef.

Change-Id: I13d86402aecf0eeec44b1abbe2b244fbc706a5eb
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>

The code here is a little confusing, the iwl_mvm_te_check_disconnect()
will check that the interface is a station, but going into it after
already having processed the time even end for P2P seems strange at
first look.

Put a switch statement there to distinguish the interface types and
make this more readable.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

We previously enabled the smart FIFO (SF) in BSS only after
association.
This cause interrupt latency on P2P on certain devices.
Change the working model to enable the SF all the time and
play with the timeout values based on the association state.
This change was not tested on older firwmares, so make it
happen only on -13.ucode and up.
Signed-off-by: NEran Harary <eran.harary@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The firmware was not using the new API, so we don't need to
differentiate between the different stages of this new API.
The main difference here is that most of the hard coded
values are not sent through the command anymore.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When a station goes to sleep, we can't transmit any frame
to it. This means that until that station will wake up, a
queue that is dedicated to this station won't progress at
all. Take this into account when monitoring stuck queues
and don't account for the time the station was asleep.
This allows to mask false positives where the queues are
stuck not because of a bug, but because of the station
being asleep.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The Tx statistics weren't updated when using fixed rate for
debugging. Fix this as Tx statistics are useful in this use case.
Signed-off-by: NEyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

RTNL is not taken during CT-kill so regulatory APIs cannot be invoked.
That's fine, since the HW is only brought up to check the temperature
during CT-kill. We don't expect Tx or scanning.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: NLuciano Coelho <luciano.coelho@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When using IBSS, it's easily possible to exhaust the number
of available stations in the driver, so don't warn on it.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Make the print a bit more readable.
Reported-by: NJoe Perches <joe@perches.com>
Signed-off-by: NEyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When entering D0i3, the MVM mutex cannot be grabbed. This interferes
with the calculation of the number of connected TDLS stations during
the setup of the power cmd.
The goal is to disable power saving for all vifs while any TDLS station
is connected. For this purpose it is enough to keep the pm_enabled
member of all mvmvifs as false. An update of the power state already
occurs when a TDLS station is added/removed, so the values are correctly
updated.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>