The subtraction of two struct ieee80211_wmm_rule pointers leaves a result
that is automatically scaled down by the size of the size of pointed-to
type, hence the division by sizeof(struct ieee80211_wmm_rule) is
bogus and should be removed.

Detected by CoverityScan, CID#1467777 ("Extra sizeof expression")

Fixes: 77e30e10 ("iwlwifi: mvm: query regdb for wmm rule if needed")
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Make sure the rx_allocator worker is canceled before running the
rx_init routine.  rx_init frees and re-allocates all rxb's pages.  The
rx_allocator worker also allocates pages for the used rxb's.  Running
rx_init and rx_allocator simultaniously causes a kernel panic.  Fix
that by canceling the work in rx_init.
Signed-off-by: NShaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Our hardware has a limited amount of buffer descriptors
for each Tx packet. Because of that, there is a short
piece of code that makes sure that that we don't push too
many subframes in an A-MSDU because of subframes needs 2
buffer descriptors. This code also takes into account the
number of fragment of the skb since we also need a buffer
descriptor for each fragment in the skb.

This piece of code though didn't check that the resulting
number of subframes wasn't 0.

A user reported that using NFS client, he could get skbs
that are so fragmented that the code mentioned above
returned 0 for the number of subframes making
skb_gso_segment fail and subconsequently iwlwifi would WARN.

Fix this by make sure that num_subframes is at least 1.

This fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=199209

Fixes: a6d5e32f ("iwlwifi: mvm: send large SKBs to the transport")
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Some versions of the FW don't support channel switch in TDLS.
Add a condition that checks it.

Fixes: 307e4723 ("iwlwifi: mvm: configure TDLS peers to FW")
Signed-off-by: NAviya Erenfeld <aviya.erenfeld@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

In some cases we may get from FW errored frames with
UNKNOWN security type.

This may happen in unsecured aggregation flow, where
the first packet had a CRC error in the WEP bit, which
was followed by a failure to decrypt and was dropped.

The next frames in the aggregation "inherit" the bad metadata
of the first packet.

Make sure to drop such frames since RADA and other offloads
will not operate correctly which may have unexpected results.

In case of AP it also causes to TX AMSDU frames to the peers,
resulting with assert 0x104B.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Recently we have switched the csr addresses and values configuration
from a single configuration to all devices to a per-device configuration.
Doing that, the configuration for 6300 devices wasn't set.
This missing definition introduced a kernel panic once trying to access
the csr's.

Add the missing 6300 csr configuration.

While at it, add a checker that the csr values were indeed
configured, and bail out more gracefully if not.

Fixes: a8cbb46f ("iwlwifi: allow different csr flags for different device families")
Signed-off-by: NGolan Ben Ami <golan.ben.ami@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Trivial fix to spelling mistake in module parameter description text
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Trivial fix to spelling mistake in comment and in the ord_data text
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In case of "any" wowlan trigger is configured, no valid wakeup filter
was configured.

Moreover, the fw assumes there's no connection when there are no configured
wakeup filters.
This leads to the station info not being updated on D3 command, causing
rate_n_flags to be 0 when the offloading code sends tx frame (triggering
SYSASSERT_102C due to invalid antenna param)

Note: "any" trigger is currently assumed to only be used when entering
d0i3 (which has a different flow). However, we still reach this code
when using d3_test.
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Firmware will only send non low-latency TIDs in the
bitmap, so the check is now redundant.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The bitfield we use in struct iwl_cfg contains 17 bits, but we declare
it as u16.  The compiler doesn't seem to have any problems with that
(it probably automatically makes it u32), but it's cleaner to use a
type that is long enough for all the flags.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

If we fail to to grab NIC access because the device is not responding
(i.e. CSR_GP_CNTRL returns 0xFFFFFFFF), remove the device from the PCI
bus, to avoid any further damage, and to let the user space rescan.

In order to inform the userspace that a rescan is needed, we send a
kobject uevent with "INACCESSIBLE".

This functionality is disabled by default, but can be enabled via a
new module parameter called "remove_when_gone".  In the future we may
change this module parameter to include 3 modes instead: do nothing;
auto-rescan or; send uevent.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: NRajat Jain <rajatja@google.com>

Now that we check and copy only the actual size of the page block,
there is no need to treat the last block separately.  Remove the
mostly duplicate code and make the main copy loop handle also the last
block.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The page loading code trusts the data provided in the firmware images
a bit too much and may cause a buffer overflow or copy unknown data if
the block sizes don't match what we expect.

To prevent potential problems, harden the code by checking if the
sizes we are copying are what we expect.

Cc: stable@vger.kernel.org
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Future changes will require moving the HE radiotap data into
the SKB head, but this means we need to have the alignment
reservation done before that. To prepare, move the alignment
reservation earlier here.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

In future devices we use different csr addresses for hw addresses.
Update csr addresses to support new and legacy devices.
Signed-off-by: NGolan Ben Ami <golan.ben.ami@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

In case of A-MSDUs, the trans layer is taking care of building
the subframes (out of the given skb), according to the given gso_size.

However, in some testing flows, we want to build the whole A-MSDU
frame in a different place (e.g. userspace), and ask the driver
to send it as-is.

In case of gso_size==0, simply treat the frame as normal-frame,
although the A-MSDU flag is set.
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The max_data_size and max_inst_size values are only needed for DVM
devices.  Remove the assignment to those fields in 7000 and newer
families so we can also remove the otherwise unnecessary inclusion of
iwl-agn.h headers.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

In future devices a new image will be introduced - IML. The IML, image
loader, is loaded by the ROM, and as part of the new self-init flow,
loads the rest of the firmware images to the device.

Store the image, so the ROM can load it to the device.
Signed-off-by: NGolan Ben Ami <golan.ben.ami@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Different device families may have different flag values
for passing a message to the fw (i.e. SW_RESET).
In order to keep the code readable, and avoid conditioning
upon the family, store a value for each flag, which indicates
the bit that needs to be enabled.
Signed-off-by: NGolan Ben Ami <golan.ben.ami@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

When version 8 of the scan command API was introduced, only the size
of version 7 was updated, causing older versions of the firmware to
throw BAD_COMMAND errors.

Calculating the old version based on the size of the latest version
got too complicated and the size of the older versions will never
change anyway, so it's better to just hardcoded the sizes.

Fixes: 66fa2424 ("iwlwifi: fw api: support the new scan request FW API version")
Reported-by: NScott Register <sreg@sreg.io>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

When trying to open aggregations on 22000 HW before
traffic had actually passed, the driver will discover
it is missing a queue to aggregate on. In such a case -
allocate a queue.
Signed-off-by: NLiad Kaufman <liad.kaufman@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

There's already an opmode common file for nvm iwl-nvm-parse.c
Move the content of fw/nvm.c to iwl-nvm-parse.c and delete fw/nvm.c.
Signed-off-by: NShaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The sku_capa_band_24GHz_enable and sku_capa_band_52GHz_enable symbols
cause checkpatch to complain whenever we use them.  To prevent this,
convert them to all lower case.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Instead of having a boolean for each modifier we need to handle in the
channel maps, create a bitmask with flags that denote each
modification.
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

NVM_GET_INFO API has changed to support indication
of 11ax support.
Signed-off-by: NLiad Kaufman <liad.kaufman@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Update rs-fw API to match changes in FW.  Specifically, the
TLC_MNG_NOTIF_REQ_CMD command and TLC_MNG_AMSDU_ENABLE_NOTIF
notification are removed, the A-MSDU related info is received from FW
via the TLC_MNG_UPDATE_NOTIF, and the TLC_MNG_CONFIG_CMD uses version
2 of its data structure.

Additionally, constify some arguments in a couple of functions.
Signed-off-by: NNaftali Goldstein <naftali.goldstein@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

22000 devices rely on this flag to install the key to the right
queues.  For earlier devices we didn't have a key / queue mapping and
the key was sent along with the Tx command for each Tx hence the
problem didn't arise.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Avoid a race where two (or more) commands get the
same index:

1. T1 calls enqueue_hcmd and the local TFD index is assigned to
   txq->write_ptr;
2. Context switch 'before incrementing txq->write_ptr';
3. T2 calls enqueue_hcmd and the local TFD index is assigned to
   txq->write_ptr;
4. Now the index is set to the same value for both commands of T1 and
   T2.

To prevent this from happening, set the local TFD index inside the
critical section (the index is set by global txq write pointer).
Signed-off-by: NShaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

This saves some typing and is overall more readable.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Move all the NVM file handling code to iwl-nvm-parse.c where all this
stuff belongs.  This cleans up the MVM specific code and allows easier
reuse by other opmodes if needed.
Signed-off-by: NShaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

In 22000 devices, aka gen2, the TFS is 256 bytes.
In order to save memory, use shorter TX queue for aux and
mgmt queues, since there isn't much traffic on them.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Op mode will begin tp use varying size of TX queue.
All the infra is in place, allow it.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

As preparation for dynamic queue sizing, add a parameter
of the TX queue size to the dynamic queue allocation op
mode API.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

This reverts commit dd05f9aa.

Shorter TX queues support was added eventually without the
need for the parameters this patch added.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

When support for shorter TX queues was introduced, it
didn't include the actual allocation of shorter queue,
which is the main motive for the change.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

These functions are not debugfs functions so they should be in dbg.h
instad in debugfs.h.
Signed-off-by: NHaim Dreyfuss <haim.dreyfuss@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

When we enable TSO, we can have a lot of packets in the
operation mode that will be pushed to the transport
no matter what is the queue's fullness state.

To cope with that the transport can buffer those packets
and add them to the ring later when there is more room.
This implementation was missing in the Gen2 devices'
code.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

Support the new APIs and activate AMSDU based on the
offloaded TLC decisions.
Signed-off-by: NSara Sharon <sara.sharon@intel.com>
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>

The code that sets the correct out-of-channel priority depending on
the scan type was accidentally removed during a rebase.  Add it back.

Fixes: c1a75153 ("iwlwifi: mvm: add adaptive dwell support")
Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>