A new callback has been added to prepare the device for a channel
switch.  Use the new callback instead of the old channel_switch_beacon
operation.

This makes it possible to remove the channel_switch_beacon operation
from mac80211.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>

Maintain a TDLS channel-switch state and update it according to
notifications from FW and timeouts. Explicitly check all state
transitions are valid.
When switching is initiated by mac80211, use a delayed work to
periodically reschedule it from iwlwifi.
Give the FW mac80211 generated TDLS channel-switch request/response
templates. It will change appropriate values (switch timings) and Tx
them at appropriate times.

Enable the channel switch wiphy capability bit when the FW supports it.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Block TID 4 (VI) on a vif when using TDLS. This TID will be used by FW
for TDLS channel-switch requests and PTI requests.
Signed-off-by: NLiad Kaufman <liad.kaufman@intel.com>
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When adding a TDLS station, allocate 4 new queues for it. Configure them
to FW and enable them. On station removal, drain the queues if needed
and disable them when empty.

Make sure to flush all packets in the private queues of TDLS stations in
the mac80211 flush() callback.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When TDLS peers are present the FW will send packets on a dedicated
TID vs. the peer when performing TDLS channel-switches. The driver
configures the TID on connection to the peer and the FW is responsible
for maintaining the state of QoS seqno and PN/IV for encryption.

If the FW asserts, the driver cannot correctly reconfigure the starting
seqno/PN to the reloaded FW, thus forcing us to reconnect the peer.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

TDLS stations will have private queues, so consider them as well when
allocating a new one. Consolidate the HW-queue iterating code into
a single exported function, to be used by the TDLS code in the future.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Send a dedicated TDLS_CONFIG command when a TDLS peer joins/leaves. The
fields for the command are mostly place-holders, as most of the FW
functionality is not implemented. In the future the dedicated FW TID
will be used for channel-switching and buffer-sta functionality.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Add a channel-switch command and a switch-start notification. Also add a
FW TLV bit indicating TDLS channel switching support.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The driver/FW combination now support TDLS.
Check the FW support with the TLV bit.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When we pre-populate the skb->head for the stack, we only pull
in the 802.11 header including crypto (assuming the packet isn't
short enough to be in there completely.) This is fine, but in
ieee80211_data_to_8023() we later unconditionally pull 8 more
bytes for the SNAP header and ethertype field (except for mesh
or 4-addr, where it's even more, but we don't care as much about
them).

Avoid the additional later pull by pulling in those 8 bytes here.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Reviewed-by: NIdoX Yariv <ido@wizery.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When we pre-populate the skb->head for the stack, we only pull
in the 802.11 header (assuming the packet isn't short enough to
be in there completely.) This is fine, but in many cases we'll
pull in the crypto headers pretty much immediately afterwards,
so to avoid that pull in the crypto header early.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Reviewed-by: NIdoX Yariv <ido@wizery.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Instead of building the rx_status on the stack and then
copying it to the skb, allocate the skb a bit earlier
and then build the rx_status in place.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Reviewed-by: NIdoX Yariv <ido@wizery.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

In the original driver, we decided to not implement WEP RX hardware
offload because of a quirk with the firmware API - it allows setting
global WEP keys that then get used for all virtual interfaces, which
is clearly wrong if more than one exists, and it allows setting per-
station keys but then separates multicast and unicast keys.

In order to implement WEP RX hardware offload, work around these
limitations by uploading each WEP key twice, once as multicast and
once as unicast, but point them both to the same key slot (offset)
and use the same key material so the slot overwrite on the second
upload doesn't actually change anything. Upon removal, also remove
the key twice so the station no longer references it.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Refactor the key add/remove functions to be able to reuse parts
of them later for RX WEP keys, which need to be uploaded twice.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Add a flow that handles the requests to cancel the roc time event,
that has been triggered via the aux framework.

The roc for bss is different than the roc for p2p devices, and  is done
via the aux framework using the aux queue, thus requires a different flow
to cancel the time event.
Signed-off-by: NMatti Gottlieb <matti.gottlieb@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Remove warning on scan complete with unknown ID, since this
scan could be already cleared in abort flow.
Signed-off-by: NDavid Spinadel <david.spinadel@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The ssid_bitmap should be unsigned, though it doesn't matter
much as the high bits aren't used.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

There is no reason to pass every 50th beacon if
nothing was changed.
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Instead of allocating nd_ies separately, make it part of the iwl_mvm
structure so it's easier to handle its lifetime.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

For background and scheduled scan, using the new unified scan API,
support random MAC address scanning.

Unfortunately, the firmware right now doesn't support randomising
itself, so for now do it on the host - we'll change this once the
firmware supports randomising the address for each scan iteration
using the address/mask.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

LMAC TLV bit may be on in FWs that support UMAC scan; so check
for UMAC TLV bit first.
Signed-off-by: NDavid Spinadel <david.spinadel@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The fw now indicates missing BA with ampdu_ack_len=0.

This will make the whole aggregation being marked
as failed, although it's most likely not the case (and
only the BA itself was failed).

Consider this case as a single tx failure.
Signed-off-by: NEyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The TTC and RRC features are supported by the newer
firmwares. It allows to reach better overall WiFi and BT
performance. When the RRC is enabled, we don't need to force
the AP to send SISO frames, but it can keeps sending MIMO
frames.
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This API uses second CPU scan commands, and can support multiple
simultaneous scans.

Adding the new API, and adding new mechanisms to deal with up to
8 simultaneous scans instead of the old scan status.

New scan API requires scan configuration for default scan parameters,
adding it in _up flow. Also updating scan configuration after updating
valid scan antennas via debugfs.
Signed-off-by: NDavid Spinadel <david.spinadel@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The driver must set the keep alive period regardless of power
management state. The keep alive period must be greater or equal to
both the NIC's maximum sleep period, and the listen interval.
However, we were confusing time units (TU) and msec, so fix that.
Signed-off-by: NAvri Altman <avri.altman@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Our firmware scheduler suffers from false wake-up on 500 time units.
that is if the dtim interval exceeds 500 time units, the fw wakes up,
understands that the next wake-up event is still ahead, and if this event
is more than 10msec in the future - goes back to sleep, otherwise - stay
awake.  For example, say that the beacon interval is 101 and the dtim
period is 5, the dtim interval is 101 x 5 = 505, and we will stay awake
for those extra 5msec.
So on the one hand the dtim interval should be congruent to the beacon
interval times the dtim period, and on the other should minimize
the false wake-ups event.
This change applies only to D0/D3 power modes.
Signed-off-by: NAvri Altman <avri.altman@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The deferred d0i3 exit is currently implemented in the
resume op, which is called when mac80211 starts its
resume process.

However, mac80211 still doesn't handle frames at this stage,
which results in frames being dropped.

Move the deferred d0i3 handling to the reconfig_complete
callback, in order to make sure mac80211 is fully available
at this point.
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

After the corresponding mac80211 patch, we can now report the airtime
used for each transmitted packet and mac80211 will be able to implement
WMM-AC with that information.

To support WMM-AC in the driver then, report the airtime and advertise
support.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Since it's too complicated for the fw to insert a DS Parameter Set
element in the middle of the frame, it was decided that it should be
done by the host. The fw will only parse the frame and update the
current channel field.
Signed-off-by: NAndrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When aborting d0i3 due to taken refs, other threads might
already wait on d0i3_exit_waitq for IWL_MVM_STATUS_IN_D0I3
to get cleared (it's somewhat likely, as synchronize_rcu()
might take a while), so make sure to wake them up.
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Currently, the firmware only sends temperature notificaitions inside
RX statistics notifications, which are tied to beacon filtering.  This
is a problem because beacon filtering is not used with vifs that don't
receive beacons (e.g. P2P GO and AP), so the driver doesn't receive
temperature notifications in those cases.  To solve that, the firmware
will be changed so that it sends DTS_MEASUREMENT_NOTIFICATIONs,
independently from the beacon filtering flows.

To support that, the driver needs to also handle unsolicited
DTS_MEASUREMENT_NOTIFICATIONs, that are not triggered by
DTS_TRIGGER_CMD_FLAGS_TEMP requests.

This change is backwards compatible and will simply not be used with
firmware versions that do not send the notifications.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Refactor the temperature handling code so that it is easier to reuse
it with other notification flows.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The code to capture firmware errors works during the reconfiguration
phase after an error. As the D3->D0 transition uses the same flow to
get the D0 image reconfigured, this triggered and caused a firmware
coredump to be collected. This in turn, if it isn't picked up by
userspace, can cause module unloading to fail, which is how the bug
was detected.

To fix this issue, introduce a new status flag (D3_RECONFIG) and use
it to detect that during reconfiguration no coredump should be taken
and reported.
Reported-by: NAvi Kraif <avix.kraif@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When we need only one antenna, we should refrain from using
the antenna that is shared with BT if BT load is high.
Fix this.
Reviewed-by: NEyal Shapira <eyal@wizery.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When Tx STBC is being used and RS switches to a search column
using the alternate antenna from the current one there is a
problem with using rs_rate_match to figure out which table
is the active and which one is the search one. The root cause
is because in STBC the antenna mask in the ucode rate is set
to ANT_AB and in this specific scenario it matches both the
active and search table (e.g. SISO_ANT_A and SISO_ANT_B).
This leads to tx stats being updated in the wrong table and later
on to getting stuck in a test window and not moving on to other
columns. If this happens during the initial search cycle we
never end it and therefore never enable aggregation which leads
naturally to severe througput degradation.
Fix it by deducing which table is which by knowing whether we're
in a search or not like it's being done in rs_rate_scale_perform
Signed-off-by: NEyal Shapira <eyalx.shapira@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Other contexts might call iwl_mvm_ref_sync() right before
we set IWL_MVM_STATUS_IN_D0I3, and then assume the fw/bus
is not in d0i3 state.

However, since we currently don't check for held references
in the d0i3_enter flow, we might enter d0i3 although there
is an active reference.

Solve it by aborting the d0i3 enter flow if there is an
active reference. Since users are assumed to use
iwl_mvm_ref_sync, which takes a ref before checking the
flag, we don't need further locking.
Signed-off-by: NEliad Peller <eliadx.peller@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This was taken care of in case we're doing STBC with HT
but not when working with VHT.
Signed-off-by: NEyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Even if running the driver with param init_dbg=1 - on INIT
image error - iwl_trans_stop_device() was still called. This
patch fixes that and calls iwl_trans_stop_device() on INIT
image failure only if init_dbg=0.
Signed-off-by: NLiad Kaufman <liad.kaufman@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This code existed but not for all the different FW APIs
we support.
Fix this.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The variable 'tid' is already defined in this function, so use
just 't' for the new one. As we return from the function just
overwriting 'tid' would be acceptable, but less obvious to the
reader.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>