- 08 Feb, 2017 16 commits
-
-
Ilan Peer authored
When removing an IGTK, iwl_mvm_send_sta_igtk() was called before station ID was retrieved, so the function was invoked with an invalid station ID. Fix this by first getting the station ID. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=192411Signed-off-by:
Ilan Peer <ilan.peer@intel.com> Signed-off-by:
Luca Coelho <luciano.coelho@intel.com>
-
Goodstein, Mordechay authored
The race happens when we send ADD_STA(auth->assoc) -> LQ_CMD between the commands the FW sometimes loses the medium for AUX, and sends a ndp to the AP and the flow becomes, ADD_STA -> send ndp -> LQ_CMD the problem is that there's no rates yet defined for sending the ndp and FW generates an assert. The fix: change the order of the commands to LQ_CMD -> ADD_STA Signed-off-by:
Mordechay Goodstein <mordechay.goodstein@intel.com> Signed-off-by:
-
Avraham Stern authored
The session protection set for association is only removed when BSS_CHANGED_BEACON_INFO is set and BSS_CHANGED_ASSOC is not set. However, mac80211 may set both on association (in case a beacon was already received). In this case, mac80211 will not set BSS_CHANGED_BEACON_INFO on the next beacons because it has already notified the beacon change, so the session protection is never removed (until the session protection ends). When a CSA is received within this time, the station will fail to folllow the channel switch because it cannot schedule the time event. Fix this by removing the session protection when BSS_CHANGED_BEACON_INFO and BSS_CHANGED_ASSOC are both set. Signed-off-by:
Avraham Stern <avraham.stern@intel.com> Signed-off-by:
-
Golan Ben Ami authored
Currently, when getting a RFKILL interrupt, the transport enters a flow in which it stops the device, disables other interrupts, etc. After stopping the device, the transport resets the hw, and sleeps. During the sleep, a context switch occurs and host commands are sent by upper layers (e.g. mvm) to the fw. This is possible since the op_mode layer and the transport layer hold different mutexes. Since the STATUS_RFKILL bit isn't set, the transport layer doesn't recognize that RFKILL was toggled on, and no commands can actually be sent, so it enqueues the command to the tx queue and sets a timer on the queue. After switching context back to stopping the device, STATUS_RFKILL is set, and then the transport can't send the command to the fw. This eventually results in a queue hang. Fix this by setting STATUS_RFKILL immediately when the interrupt is fired. Signed-off-by:
Golan Ben-Ami <golan.ben.ami@intel.com> Signed-off-by:
-
Emmanuel Grumbach authored
In https://bugzilla.kernel.org/show_bug.cgi?id=177341 Bob reported a UBSAN WARNING on rs.c in iwldvm. Fix the same bug in iwlmvm. This because i = index - 1; for (mask = (1 << i); i >= 0; i--, mask >>= 1) is unsafe: i could be negative and hence we can call << on a negative value. This bug doesn't have any real impact since the condition of the for loop will prevent any usage of mask. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=177341Signed-off-by:
Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by:
-
Emmanuel Grumbach authored
In https://bugzilla.kernel.org/show_bug.cgi?id=177341 Bob reported a UBSAN WARNING on rs.c. Undefined behaviour in drivers/net/wireless/intel/iwlwifi/dvm/rs.c:746:18 This because i = index - 1; for (mask = (1 << i); i >= 0; i--, mask >>= 1) is unsafe: i could be negative and hence we can call << on a negative value. This bug doesn't have any real impact since the condition of the for loop will prevent any usage of mask. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=177341Signed-off-by:
-
Emmanuel Grumbach authored
Enabling the RTPM Kconfig option can be fairly risky. Runtime PM must be validated against a specific platform before it can be safely enabled. Hence, it makes no sense for distros and other big OS vendors to enable it since they ship code to various systems and unknown platform. Make sure that this is hinted properly by making the IWLWIFI_PCIE_RTPM Kconfig option depend on EXPERT. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=172411Signed-off-by:
-
Emmanuel Grumbach authored
David reported that the code I added uses the decrement and increment operator on a boolean variable. Fix that. Fixes: 0cd58eaa ("iwlwifi: pcie: allow the op_mode to block the tx queues") Reported-by:
David Binderman <dcb314@hotmail.com> Signed-off-by:
-
Emmanuel Grumbach authored
When we send a deauth to a station we don't know about, we need to use the PROBE_RESP queue. This can happen when we send a deauth to a station that is not associated to us. Signed-off-by:
-
Sara Sharon authored
When NSSN is behind the reorder buffer due to timeout the reorder timer isn't getting re-armed until NSSN catches up. Fix it. Fixes: 0690405f ("iwlwifi: mvm: add reorder timeout per frame") Signed-off-by:
Sara Sharon <sara.sharon@intel.com> Signed-off-by:
-
Sara Sharon authored
In DQA mode, first_agg_queue is initialized to IWL_MVM_DQA_MIN_DATA_QUEUE. This causes two bugs in the tx response flow: 1. When TX fails, we set IEEE80211_TX_STAT_AMPDU_NO_BACK regardless if we actually have aggregation open on the queue. This causes mac80211 to send a BAR frame even though there is no aggregation open. Fix that by simply checking the AMPDU flag that is set on by mac80211 for AMPDU packets. 2. When reclaiming frames in aggregation mode, we reclaim based on scheduler ssn and not the SN. The reason is that scheduler ssn may be ahead of SN due to a hole in the BA window that was filled. However, if we have aggregations open on IWL_MVM_DQA_BSS_CLIENT_QUEUE the reclaim flow will still go to the code of non-aggregation instead of the aggregation code since IWL_MVM_DQA_BSS_CLIENT_QUEUE is smaller than IWL_MVM_DQA_MIN_DATA_QUEUE, although it is a valid aggregation queue. Fix that by always using the aggregation reclaim code by default in DQA mode (currently it is implicitly used by default for all queues except the reserved BSS queue). Fixes: cf961e16 ("iwlwifi: mvm: support dqa-mode agg on non-shared queue") Signed-off-by:
-
Gregory Greenman authored
Handling of the number of space time streams was missing for HT rate in rate printing function. Fix it. Signed-off-by:
Gregory Greenman <gregory.greenman@intel.com> Signed-off-by:
-
Golan Ben Ami authored
When getting RF_KILL and disabling radio, the device gets stopped and reset. This erases the IVAR table that matches the interrupt to its cause, and is essential for MSIX proper functionality. Till now, the table wasn't re-configured after the reset, and therefore the interrupt that enabled radio didn't fire on the right irq, and the driver didn't handle it correctly. To fix this, configure the IVAR table again after resetting the device. Signed-off-by:
-
Haim Dreyfuss authored
During the suspend/resume flow some HW blocks are reset. This causes the IVAR table to be completely erased. This table is where interrupt causes are bound to specific IRQs. When the table is empty the interrupt handlers are not called correctly. Fix this by reconfiguring the IVAR table after resume. Fixes: 2e5d4a8f ("iwlwifi: pcie: Add new configuration to enable MSIX") Signed-off-by:
Haim Dreyfuss <haim.dreyfuss@intel.com> Signed-off-by:
-
Haim Dreyfuss authored
The MSIX configuration flow includes two different stages: configuring the HW by writing to the IVAR table and configuring the SW to reflect the HW configuration. The HW configuration is needed on each HW reset, whereas the SW configuration is only needed during the init flow. Signed-off-by:
-
Haim Dreyfuss authored
msix configuration functions should be called by other functions. For example by pcie_d3_resume, move it above to enable it. Signed-off-by:
-
- 06 Feb, 2017 12 commits
-
-
Sara Sharon authored
Support new version of beacon template command which deprecates the use of the tx command inside. Signed-off-by:
-
Johannes Berg authored
When resuming, it's possible for the following scenario to occur: * iwl_pci_resume() enables the RF-kill interrupt * iwl_pci_resume() reads the RF-kill state (e.g. to 'radio enabled') * RF_KILL interrupt triggers, and iwl_pcie_irq_handler() reads the state, now 'radio disabled', and acquires the &trans_pcie->mutex. * iwl_pcie_irq_handler() further calls iwl_trans_pcie_rf_kill() to indicate to the higher layers that the radio is now disabled (and stops the device while at it) * iwl_pcie_irq_handler() drops the mutex * iwl_pci_resume() continues, acquires the mutex and calls the higher layers to indicate that the radio is enabled. At this point, the device is stopped but the higher layers think it's available, and can call deeply into the driver to try to enable it. However, this will fail since the device is actually disabled. Signed-off-by:
Johannes Berg <johannes.berg@intel.com> Signed-off-by:
-
Sara Sharon authored
Support differentiating between two phys for a000 devices in order to load the correct firmware. Eventually when moving completely to the new phy we will be able to remove this. Signed-off-by:
-
Luca Coelho authored
The iwl_drv structure contains trans which already contains cfg, so storing cfg separately in iwl_drv is redundant. Remove it and access trans->cfg instead. Signed-off-by: -
Luca Coelho authored
When iwl_drv_start() is called, trans->cfg must already be set, so there's no need to pass cfg separately, since it can be accessed directly from trans->cfg. Signed-off-by:
-
Sara Sharon authored
Unify code, remove redundant assignments. Signed-off-by:
-
Johannes Berg authored
When a small frame is copied completely into the skb->head, the code doesn't take alignment into account, making mac80211 copy it again later on architectures that need the alignment. Avoid this by taking the PAD flag from the device into account when copying. Signed-off-by:
-
Sara Sharon authored
In DQA mode the check whether to decrement the pending frames counter relies on the tid status and not on the txq id. This may result in an inconsistent state of the pending frames counter in case frame is queued on a non aggregation queue but with this TID, and will be followed by a failure to remove the station and later on SYSASSERT 0x3421 when trying to remove the MAC. Such frames are for example bar and qos NDPs. Fix it by aligning the condition of incrementing the counter with the condition of decrementing it - rely on TID state for DQA mode. Also, avoid internal error like this affecting station removal for DQA mode - since we can know for sure it is an internal error. Fixes: cf961e16 ("iwlwifi: mvm: support dqa-mode agg on non-shared queue") Signed-off-by:
-
Sara Sharon authored
Our 9000 device supports 64 bit DMA address for RX only, and not for TX. Setting DMA mask to 64 for the whole device is erroneous - we can do it only for a000 devices where device is capable of both RX & TX DMA with 64 bit address space. Fixes: 96a6497b ("iwlwifi: pcie: add 9000 series multi queue rx DMA support") Signed-off-by:
-
Liad Kaufman authored
A few of the static queues are enabled along with the bcast STA. Make sure they are removed along with it, rather than waiting for the mac ctxt release. This is needed because we sometimes have a STA being removed and then added again (either with the same sta_id or a different one). If we wait for the mac ctxt release we will try to allocate the queues again (as this is currently done in the STA allocation and not in the MAC init) although they weren't freed, and even if the sta_id of the STA has changed. Signed-off-by:
Liad Kaufman <liad.kaufman@intel.com> Signed-off-by:
-
Johannes Berg authored
Instead of setting the tx_cmd length in the mvm code, which is complicated by the fact that DQA may want to temporarily store the SKB on the side, adjust the length in the PCIe code which also knows about this since it's responsible for duplicating all those headers that are account for in this code. As the PCIe code already relies on the tx_cmd->len field, this doesn't really introduce any new dependencies. To make this possible we need to move the memcpy() of the TX command until after it was updated. This does even simplify the code though, since the PCIe code already does a lot of manipulations to build A-MSDUs correctly and changing the length becomes a simple operation to see how much was added/removed, rather than predicting it. Fixes: 24afba76 ("iwlwifi: mvm: support bss dynamic alloc/dealloc of queues") Signed-off-by:
-
Johannes Berg authored
We don't really need clear the skb's status area nor store the dev_cmd into it until we really commit to the frame by handing it to the transport - defer those operations until just before we do that. This doesn't entirely fix the bug with frames not getting sent out after having been deferred due to DQA, because it doesn't restore the info->driver_data[0] place that was already set to zero (or another value) by the A-MSDU logic. Fixes: 24afba76 ("iwlwifi: mvm: support bss dynamic alloc/dealloc of queues") Signed-off-by:
-
- 03 Feb, 2017 12 commits
-
-
Johannes Berg authored
The firmware will soon actually look at the AID field, and when it does that it'll try to ensure that the AID is never changing. Due to the way the station is added, it may start with an invalid AID before it's associated, so to ensure a constant AID (once it becomes non-zero), track the station state and set the AID only when the station is associated and when it disassociates. Signed-off-by:
-
Johannes Berg authored
This fixes a long-standing bug that was introduced when this code was introduced: cfg80211 passes a pointer, but we treat it as if it was passing a value. The result is that we pass the pointer to the firmware, instead of the value. It's not clear how this could ever have worked, unless the firmware is ignoring this value. Signed-off-by:
-
Sara Sharon authored
When driver needs to access the contents of a streaming DMA buffer without unmapping it it should call dma_sync_single_for_cpu(). Once the call has been made, the CPU "owns" the DMA buffer and can work with it as needed. Before the device accesses the buffer, however, ownership should be transferred back to it with dma_sync_single_for_device(). Both calls weren't performed by the driver, resulting with odd paging errors on some platforms. Fix it. Fixes: a6c4fb44 ("iwlwifi: mvm: Add FW paging mechanism for the UMAC on PCI") Signed-off-by:
-
Sara Sharon authored
Support getting alive from two LMACs and dumping debug data from both. Deprecate older alive notifications no one is using. Signed-off-by:
-
Johannes Berg authored
There's already a variable with the result in scope, use that. Signed-off-by:
-
Sara Sharon authored
If iwl_mvm_find_free_queue() doesn't find a free queue, it will return an inactive one. However, not all the call paths free this queue before reassigning it, which is a bug. Check it in other paths and act accordingly. Fixes: 9794c64f ("iwlwifi: mvm: support dqa queue inactivation upon timeout") Signed-off-by:
-
Sara Sharon authored
For CDB devices we will want to configure scan parameters per band. Support the new scan API for now. Logic per band will be added in the future. Signed-off-by:
-
Sara Sharon authored
For CDB arch there is another auxiliary mac. Support statistics APIs that were changed to reflect that. Signed-off-by:
-
Sara Sharon authored
Currently we have up to 3 phy contexts - defined by NUM_PHY_CTX. However - some code paths validate the ID by using MAX_PHYS define which is set to 4. While there is no harm it is incorrect - since the maximum is 3. Remove the define and use the correct one. Cleanup the code a bit while at it. Signed-off-by:
-
Beni Lev authored
Since offchannel activity doesn't always require a BSS, e.g. ANQP sessions, offchannel frames should not use the BSS queue, because it might not be initialized. Use the auxilary queue instead Fixes: e3118ad7 ("iwlwifi: mvm: support tdls in dqa mode") Signed-off-by:
Beni Lev <beni.lev@intel.com> Signed-off-by:
-
Golan Ben-Ami authored
Add to the v1 of the mfuart loading notification, the size of the mfuart image, and write it to dmesg once the notification is received. Signed-off-by:
-
Sara Sharon authored
For a000 devices the INIT and RT images are unified to one image. The changes in the flow are the following: * Driver load only RT firmware - meaning that the nvm access command will be done in the RT image load flow. * A new command (NVM_ACCESS_COMPLETE) now signals to the FW that the driver is done accessing the NVM and FW can proceed with phy calibrations. * Phy DB is no longer sent from INIT FW to be restored by driver for the RT FW - all the phy DB is now internal to the FW. INIT complete will now follow the NVM access command, without phy DB calls before. * Paging command is sent earlier in the flow before NVM access to enable a complete load of FW. * caution must be care when restart is called since we may have not completed init flow even though we are in RT firmware. Signed-off-by:
-
