When the op_mode sends an skb whose payload is bigger than
MSS, PCIe will create an A-MSDU out of it. PCIe assumes
that the skb that is coming from the op_mode can fit in one
A-MSDU. It is the op_mode's responsibility to make sure
that this guarantee holds.

Additional headers need to be built for the subframes.
The TSO core code takes care of the IP / TCP headers and
the driver takes care of the 802.11 subframe headers.

These headers are stored on a per-cpu page that is re-used
for all the packets handled on that same CPU. Each skb
holds a reference to that page and releases the page when
it is reclaimed. When the page gets full, it is released
and a new one is allocated.

Since any SKB that doesn't go through the fast-xmit path
of mac80211 will be segmented, we can assume here that the
packet is not WEP / TKIP and has a proper SNAP header.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The transport will need to use the info->driver_data
pointers. Since the op_mode has this memory hot in cache,
clear it there.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The code that handles the TBs that contain the WiFi payload
will be changed for TSO. Move the current code into a
separate function.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Differentiate between the cases where the skb is a large
send and the other cases.
Advertise TSO even if, at this stage, skb_gso_segment will
be called and it will do all the work.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Allow to configure the driver to pretend to have TX CSUM
offload support. This will be useful to test the TSO flows
that will come in further patches.
This configuration is disabled by default.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

ilw@linux.intel.com is not available anymore.
linuxwifi@intel.com should be used instead.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

* don't load firmware that won't exist for 7260
* fix RCU splat

Move constants to the right of binary operators.

Generated by: scripts/coccinelle/misc/compare_const_fl.cocci

type=cleanup
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

RFC4862 states that "In all cases, a node MUST NOT respond to
a Neighbor Solicitation for a tentative address".
Currently the driver configures the NS offload and does not wait
for address to become permanent, thus violating the RFC.
Just removing the address from the address list is not good enough
for all cases, since the NS messages are needed for the duplicate
address detection and should not be discarded.

For d0i3 disable NS offload. Put tentative address in the address
list so the NS packet will not be filtered out by ucode.
For D3 the platform will not wake from NS packets - so enable
NS offload while removing the tentative address from the list.

Given that now NS offload might be disabled, and that the ucode
uses the IP data for other puroposes (L3 filtering) add two
independent flags indicating if IPv4\IPv6 data is valid.
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Today, in order to configure fw in usniffer mode, the ucode
must have the corresponding tlv, which is revealed to the driver
while parsing the ucode.

Expose the mode of the usniffer to other utilities in the driver
(other than the ucode parser) by passing back a pointer to the value.
This can be very useful for allowing configuring the fw dbg data
using an external configuration file, because this configuration
depends on the fw usniffer mode.
Signed-off-by: Golan Ben-Ami <golan.ben.ami@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Properly protect the RCU dereference in iwl_mvm_get_key_sta_id() when
coming from iwl_mvm_update_tkip_key() which cannot hold the mvm->mutex
by moving the call into the RCU critical section.
Modify the check to use rcu_dereference_check() to permit this.

Fixes: 9513c5e1 ("iwlwifi: mvm: Avoid dereferencing sta if it was already flushed")
Reported-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The 7260 devices aren't going to be updated for completely new
firmware versions any more (only bugfixes), and haven't been
since API version 17. Encode that in the data structures to
avoid trying to load FW images that will never exist.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The d0i3_mode variable is used to distinguish between transports that
handle d0i3 entry during suspend by themselves (i.e. the slave
transports) and those which rely on the op_mode layer to do it.  The
reason why the former do it by themselves is that they need to
transition from d0i3 in runtime_suspend into d0i3 in system-wide
suspend and this transition needs to happen before the op_mode's
suspend flow is called.

The wowlan_d0i3 element is also a bit confusing, because it just
reflects the wowlan->any value for the trans to understand.  This is a
bit unclear in the code and not generic enough for future use.

To make it clearer and to generalize the platform power mode settings,
introduce two variables to indicate the platform power management
modes used by the transport.

Additionally, in order not to take too big a step in one patch, treat
this new variables semantically in the same way as the old d0i3_mode
element, introducing a iwl_mvm_enter_d0i3_on_suspend() function to
help with that.

This commit also adds the foundation for a new concept where the
firmware configuration state (i.e. D0, D3 or D0i3) is abstracted from
the platform PM mode we are in (i.e. runtime suspend or system-wide
suspend).
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Remove the vif parameter of iwl_mvm_configure_bcast_filter()
as it's not being used.
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

d0i3 commands are not supported in the init image, so take
a reference to ensure we don't enter d0i3 during init image,
and additional checks to prevent d0i3 commands when no
fw image is loaded.

Add a few WARN_ON_ONCE to the d0i3 enter/exit commands
to ensure we send d0i3 commands only when the normal
ucode is loaded.
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

When we have holes in the BA window, there might be frames
that have been ACKed between the read and the right
pointers. This means that these frames won't be scheduled
again by the SCD and the firwmare won't see them.
This invalidates the number of frames we tell the firmware
to send. When we detect this case, tell mac80211 to close
the SP and to send an EOSP so that the firmware can be in
sync.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

This pull request got a bit bigger than I wanted, due to
needing to reshuffle and fix some bugs. I merged mac80211
to get the right base for some of these changes.

 * new mac80211 API for upcoming driver changes: EOSP handling,
   key iteration
 * scan abort changes allowing to cancel an ongoing scan
 * VHT IBSS 80+80 MHz support
 * re-enable full AP client state tracking after fixes
 * various small fixes (that weren't relevant for mac80211)
 * various cleanups

Host commands now have a group id, express this in printed messages.
Signed-off-by: Sharon Dvir <sharon.dvir@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

This function got too big to be inlined. Uninline it.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

We send an ADD_STA to instruct the firmware to release
frames despite the peer being in PS.
Since the ADD_STA command and the Tx frame that comes
immediately afterwards can be reordered by the DMA engine,
we need to block the Tx queues until the firmware replies
with the ADD_STA response.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

This allows the op_mode to request from the transport to
call a callback when an ASYNC commands is completed by
the firmware. The same callback will be called for all the
commands. Pass the command whose response triggers the
callback as a parameter to the callback itself.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

In certain flows (see next patches), the op_mode may need to
block the Tx queues for a short period. Provide an API for
that. The transport is in charge of counting the number of
times the queues are blocked since the op_mode may block the
queues several times in a row before unblocking them.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit 9a4c830007817e ("iwlwifi: mvm: refactor d3 key
update functions") refactored some code into
iwl_mvm_wowlan_config_key_params() function, but the
return value was never checked, and not all the function
flows returned valid values. fix it.

Fixes: ac8ef0ce ("iwlwifi: mvm: refactor d3 key update functions")
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

iwl_mvm_restart_cleanup() calls ieee80211_remain_on_channel_expired()
on cleanup, but it doesn't clean the actual roc time
events, resulting in failure of further ROC attempts.

Refactor iwl_mvm_stop_roc() a bit, and add a new function
to only cleanup the roc time events (without sending further
commands).
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Smatch prints a static checker warning here:

    drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c:386 iwl_dump_prph()
    warn: curly braces intended?

Curly braces are NOT intended, the extra tab was added by mistake in
commit 1a616dd2 ('iwlwifi: dump prph registers in a common place
for all transports').

type=cleanup
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

If the transport supports it, advertise NETIF_F_SG to mac80211 to
be able to use frag SKBs. This will already improve performance by
allowing software GSO to be used.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

If the transport supports it, advertise NETIF_F_SG to mac80211 to
be able to use frag SKBs. This will already improve performance by
allowing software GSO to be used.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Klocwork pointed these out. There is a theoretical possibility
that rate->index might be set to IWL_RATE_INVALID (15).
This could trigger an out of bounds access on ht_vht_rates or
legacy_rates arrays. Fix it by adding some checks.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Change scan configuration (dwell time, suspend time etc.) according
to traffic conditions. This is useful for scans that are managed by
the FW (e.g. scheduled scan).
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

When sending the first ADD_STA HCMD for a STA, the %add_modify
field indicates an addition of a STA and not a modification
of one. In such a case, all fields of the HCMD are used to
initialize the corresponding fields in the FW, regardless of
what bits are set in %modify_mask.

Set the %tid_disable_tx field to mvm_sta->tid_disable_agg in
iwl_mvm_sta_send_to_fw(). If the STA is only updated this will
have no effect, but if it is added - it will make sure the
STA starts with the correct queues - if any - configured as
non-aggregated by default (until told otherwise).
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Extend the configurable option of setting initial rate to RSSI based.
Make the initial rate to be set to VHT/HT SISO or legacy depending on
the AP capabilities.
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

In case of HW ROC, when the driver reports that the ROC expired,
it is not sufficient to purge the ROCs based on the remaining
time, as it possible that the device finished the ROC session
before the actual requested duration.

To handle such cases, in case of ROC expired notification from
the driver, complete all the ROCs which are marked with hw_begun,
regardless of the remaining duration.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

There is no reason to keep a reference when the interface is down,
since we are not really doing anything.  The reference is only needed
when the mac80211 start op (or a hw restart) is running, to prevent
going into runtime or system supend in the meantime.  This will allow
us to support runtime PM when the interface is down (in another
patch).
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

If a packet is received from netlink with the frequency value set it is
checked against the current radio's frequency and discarded if different.
The frequency is also checked against data2->tmp_chan to support the "hw"
off-channel/scan case.
Signed-off-by: Adam Welle <arwelle@cert.org>
[allow both simultaneously, add locking]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

If the rate control algorithm messed up then the txrate pointer
here could be NULL - WARN and drop the packet from monitoring.
Signed-off-by: Amit Khatri <amit.khatri@samsung.com>
Signed-off-by: Rahul Jain <rahul.jain@samsung.com>
[rewrite commit message, add warning]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

When cancelling, you can cancel "any" (first in list) mgmt-tx
or remain-on-channel operation by using the value 0 for the
cookie along with the *opposite* operation, i.e.
 * cancel the first mgmt-tx by cancelling roc with 0 cookie
 * cancel the first roc by cancelling mgmt-tx with 0 cookie

This isn't really that bad since userspace should only pass
cookies that we gave it, but could lead to hard-to-debug
issues so better prevent it and reject zero values since we
never hand those out.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Instead of using pointers, use sequentially assigned cookies.
This is easier to understand while debugging and also avoids
problems when the pointer is reused for the next allocation.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

VHT can be used with IBSS without needing any additional changes in
mac80211_hwsim, so start claiming support for this to increase test
coverage.
Signed-off-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Previously, this was done only for Beacon frames, but similar timestamp
update is needed for Probe Response frames to make these more accurately
match the real IEEE 802.11 behavior. Previously, all zeros timestamp was
sent in Probe Response frames.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

While it was possible to create an IBSS with 80+80 MHz channel, joining
such an IBSS resulted in falling back to 20 MHz channel with VHT
disabled due to a missing switch case for 80+80.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>