qos_seq points (to a struct) inside the command response data.
Make sure to free the response only after qos_seq is not
needed anymore.
Reported-by: Heng Luo <heng.luo@intel.com>
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
There are buses that can't handle ASYNC command without
copying them. Duplicate the host command instead.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
fw_status is the only pointer pointing to a block of memory
allocated above and should be freed after use.
Note: this come from Klockwork static analyzer.
Cc: stable@vger.kernel.org [3.19+]
Fixes: 2021a89d7b ("iwlwifi: mvm: treat netdetect wake up separately")
Signed-off-by: Haim Dreyfuss <haim.dreyfuss@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
A few triggers have status = MLME_SUCCESS and they are still
interesting. E.g. if we want to collect data upon deauth,
the status will be MLME_SUCCESS. Fix that.
Fixes: d42f535034 ("iwlwifi: mvm: add trigger for firmware dump upon MLME failures")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
There are devices that forbid MIMO by the mean of the NVM.
Detect thoses devices and forbid MIMO otherwise the firmware
would crash. STBC is still allowed on these devices.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
During firmware restart, the quota command isn't calculated multiple
times, but after the firmware restart it has to be sent, so force it.
Otherwise the firmware crashes.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
I forgot to rename the CPTCFG_ prefix...
Fixes: 484b3d13b4 ("iwlwifi: mvm: add debugfs entry with the number of net-detect scans")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Our device needs two different firmwares: the INIT firmware
and the operational (OPER) firmware. The first one is run
when the driver loads and it returns calibrations results
as well as the NVM. The second one implements the WiFi
protocol.
If the wlan interface is not brought up, the device is put
to low power state: no firmware will be running. When the
interface is brought up, we would run the OPER firmware
only and reuse the results of the run of the INIT firmware
when the driver was loaded. This is changing with this
patch.
We now run the INIT firmware every time mac80211 calls
start(). The penalty for that is minimal since the INIT
firwmare run fast. I now also avoid to power down the device
between the INIT and OPER firmware on certains buses.
The motivation for this change is that there are components
on the device (MFUART) that are triggered by the INIT
firmware and need the device to be powered up in order to
keep running. Powering the device down between the INIT and
OPER firmware would stop these components and prevent them
from running again since they are triggered by the INIT
firmware only.
The new flow allows this and also allows to trigger these
components again when the interface is brought up after
it has been brought down.
Signed-off-by: Eran Harary <eran.harary@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
If for some reason statistics notification received from the firmware
reports 0 in average beacon RSSI value, then skip it and avoid signal
based decisions.
Signed-off-by: Alexander Bondar <alexander.bondar@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Scan iteration complete notification handling uses the wrong FW API
version (version 2 instead of version 3).
Fix that by removing version 2 API which is no longer used, and using
only the updated version.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Reviewed-by: David Spinadel <david.spinadel@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
When the delay paramatere is provided, we need to stop
the collection only after the delay has elapsed.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
The firmware doesn't relate the scan to a vif. The scan is
run by a separate entity called auxiliary MAC (aka AUX MAC).
This AUX MAC needs to get Tx power limitations that are
not applied on a specific vif, but on the device as a whole.
This can be implemented by using the minimum of all the
values set by the user for all the MACs. But then we need
to ignore the limitations that come from the AP or
regulatory for a specific vif: a specific vif might have
regulatory limitations because of the channel is works on.
This limit is irrelevant for the AUX MAC.
Use the new API from mac80211: the user_power_level in
bss_conf to achieve this.
Firmware -13.ucode has already moved to this API.
Change-Id: Ifba83660f378e91b93bd46d29fe8ba35a7c168a4
Signed-off-by: Avri Altman <avri.altman@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Conflicts:
drivers/net/usb/asix_common.c
drivers/net/usb/sr9800.c
drivers/net/usb/usbnet.c
include/linux/usb/usbnet.h
net/ipv4/tcp_ipv4.c
net/ipv6/tcp_ipv6.c
The TCP conflicts were overlapping changes. In 'net' we added a
READ_ONCE() to the socket cached RX route read, whilst in 'net-next'
Eric Dumazet touched the surrounding code dealing with how mini
sockets are handled.
With USB, it's a case of the same bug fix first going into net-next
and then I cherry picked it back into net.
Signed-off-by: David S. Miller <davem@davemloft.net>
The only other way to catch these would have been to monitor
the Tx deauth event, but we can send a deauth when we roam.
So it would have been tricky to make sure we capture the
connection losses only.
Define a separate trigger for the connection losses to make
it easier to catch them.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
This will allow to collect data when a time event
notifcation with a certain id and action is coming from
the firmware. This can be very useful to debug various
flows.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
The current code has a lot of duplicates of printing into a buffer
(while having to make sure it's NUL-filled and -terminated) and
then passing that to the debug trigger collection.
Since that's error-prone, instead make the debug trigger collection
function take a format string and format arguments (with compiler
validity checking) and handle the buffer internally.
This makes one behavioural change -- instead of sending the whole
buffer to userspace (clearing is needed to not leak stack data) it
just passes the actual string (including NUL-terminator.)
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Lots of updates for net-next; along with the usual flurry
of small fixes, cleanups and internal features we have:
* VHT support for TDLS and IBSS (conditional on drivers though)
* first TX performance improvements (the biggest will come later)
* many suspend/resume (race) fixes
* name_assign_type support from Tom Gundersen
The str/len arguments to iwl_fw_dbg_trigger_simple_stop() aren't used,
and for a simple trigger don't really need to be used as the trigger
code itself encodes the reason, so remove them.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Sending multiple action frames off channel, one after the other can create
a race that will result in a timeout:
1. Start sending action frame off channel.
2. Once the frame is sent or the time event is over, the flow will
eventually call ieee80211_start_next_roc to start the next roc frame &
iwl_mvm_roc_finished schedules to schedule a work to flush the queue.
3. Start sending new roc frame and write it to the queue before the
flush work has started.
4. The work is called and it flushes the new packet that was placed on the
on the queue so the packet is lost.
This causes the frame to be removed & not sent, that causes a timeout in
userspace.
Flush the work queue that flushes the roc/off channel queue before starting
to send a new frame off channel, in order to avoid a race between the new
frame that is transmitted off channel & the flushing of the queue.
Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Currently the last found MCC is reconfigured only in the recovery flow.
But it should always be used when available, for the ifdown/up or
RF-Kill/CT-Kill scenarios.
While at it, fix a couple of bugs in the init-from-last-MCC flow. Return
an error value when a current MCC is not found. Pass on the regdomain to
cfg80211 only if it was changed and don't ignore the return value from
the cfg80211-setter function.
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Our testers need to know the number of scans performed while in
net-detect mode before the device wakes up. The firmware already
passes this information to the driver, so we can save it and report it
in a debugfs entry.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Kalle Valo says:
====================
Major changes:
ath9k:
* add Active Interference Cancellation, a method implemented in the HW
to counter WLAN RX > sensitivity degradation when BT is transmitting
at the same time. This feature is supported by cards like WB222
based on AR9462.
iwlwifi:
* Location Aware Regulatory was added by Arik
* 8000 device family work
* update to the BT Coex firmware API
brmcfmac:
* add new BCM43455 and BCM43457 SDIO device support
* add new BCM43430 SDIO device support
wil6210:
* take care of AP bridging
* fix NAPI behavior
* found approach to achieve 4*n+2 alignment of Rx frames
rt2x00:
* add new rt2800usb device DWA 130
rtlwifi:
* add USB ID for D-Link DWA-131
* add USB ID ASUS N10 WiFi dongle
mwifiex:
* throughput enhancements
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Johannes Berg says:
====================
Lots of updates for net-next; along with the usual flurry
of small fixes, cleanups and internal features we have:
* VHT support for TDLS and IBSS (conditional on drivers though)
* first TX performance improvements (the biggest will come later)
* many suspend/resume (race) fixes
* name_assign_type support from Tom Gundersen
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
We will be able to add more events, such as MLME events and
others. The low level driver may be interested in knowing
about these events to dump firmware data upon failures, or
to change parameters in case connection attempts fail etc...
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
In the reset flow, the driver cancels ongoing scan and sends scan
complete notification to mac80211. However it does not clean its UID.
Add cleaning scan UID for the ongoing scan. Loop over all other UIDs
to make sure there's nothing left there and warn if any is found.
Signed-off-by: Alexander Bondar <alexander.bondar@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
There is a strong relationship between the NVM version and
the hardware step. Enforce that in the driver in case the
default NVM on the platform is the wrong one.
Signed-off-by: Eran Harary <eran.harary@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Sometimes we will want to configure the timeouts for the
Tx queues based on the vif type. Allow to do that using the
trigger mechanism.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
There is no need to implement the enable_scan_iteration_notif handling
explicitly and there's no reason not to export the current value. So
use debugfs_create_bool() instead.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Add support for delaying the start of a scheduled scan (or a WoWLAN
net-detect scan).
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
The AP_START d0i3 reference was never removed if the AP started correctly.
This has the unpleasant side-effect of preventing D0i3 on Android if the
WiFi hotspot was ever started on the device.
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Conflicts:
drivers/net/ethernet/emulex/benet/be_main.c
net/core/sysctl_net_core.c
net/ipv4/inet_diag.c
The be_main.c conflict resolution was really tricky. The conflict
hunks generated by GIT were very unhelpful, to say the least. It
split functions in half and moved them around, when the real actual
conflict only existed solely inside of one function, that being
be_map_pci_bars().
So instead, to resolve this, I checked out be_main.c from the top
of net-next, then I applied the be_main.c changes from 'net' since
the last time I merged. And this worked beautifully.
The inet_diag.c and sysctl_net_core.c conflicts were simple
overlapping changes, and were easily to resolve.
Signed-off-by: David S. Miller <davem@davemloft.net>
The firmware frequently manages to trigger this, and there's
no known driver workaround, so stop warning.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
we unref IWL_MVM_REF_UCODE_DOWN on iwl_mvm_restart_complete().
Usually, the restart is initiated by iwl_mvm_nic_restart(),
which takes the reference before restarting the hw.
However, in D3 flow we might call ieee80211_restart_hw()
directly (in case of suspend error and on d3_test-resume),
which without taking the ref first. fix it.
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
When the driver callback returns that it's out of space for new
stations, the mac80211 IBSS code still keeps the station so it
doesn't try to add it over and over again.
Since the rate scaling algorithm is separate in mac80211, it also
invokes the rate scaling algorithm for such stations. It doesn't
know that our rate scaling algorithm is tightly integrated with
the MVM code and relies on those data structures, and it cannot
as the abstraction doesn't allow for it.
This leads to crashes when the rate scaling algorithm tries to
use uninitialized data, notably the mvmsta->vif pointer.
Protect against this in the rate scaling algorithm. We cannot get
good rates with such peers anyway since the firmware cannot do
anything with them.
This should fix https://bugzilla.kernel.org/show_bug.cgi?id=93461
CC: <stable@vger.kernel.org>
Reported-by: Richard Taylor <rjt-kernel@thegrindstone.me.uk>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
This warning is misleading. In many cases, for example P2P ROC time
events, this will happen if the time event is aborted, for example
due to a higher priority time event. This is entirely normal and not
worth warning about.
In other cases, where we actually do act upon this, for example when
trying to connect and this fails, we should instead warn as part of
the disconnect operation.
Change the code to do that, i.e. make the warning a debug message,
and make it more prominent (an error) when we actually disconnect
because of it.
This also fixes confusion in the logs - the warning was mistaken for
something that needed investigation, while in most cases it's just
expected behaviour that occasionally some lower-priority time events
would not complete fully.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
In 8000 HW family B-step only, the ICCM is separate
from the SRAM. This adds the ICCM to the dump data
collected for FW debug.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
There are transport that must buffer frames in the driver.
This means that we have frames that are not in the op_mode
and not visible to the firwmare. This causes issues when we
flush the queues: the op_mode flushes a queue, and the
firmware flushes all the frames that are *currently* on the
rings, but if the transport buffers frames, it can submit
these while we are flushing. This leads to a situation
where we still have frames on the queues after we flushed
them.
Preventing those buffered frame from getting into the
firmware is possible, but then, we have to run the Tx
response path on frames that didn't reach the firmware
which is not desirable.
The way I solve this here is to let these frames go to the
firmware, but make sure the firmware will not transmit them
(by setting the station as draining). The op_mode then needs
to wait until the transport itself is empty to be sure that
the queue is really empty.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
According to FW methodology, the capability bits should be the only ones
that change per-HW. The API bits should remain constant across different
HWs.
Currently this is not the case with multi-source LAR (API bit 9). Assign
a new capability bit to eventually replace the API bit. Until the API bit
can be deprecated, the driver will check either to enable multi-source
LAR.
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
If, on a GO, the CSA time event fails to be scheduled, continue the
flow towards mac80211's state machine so it doesn't get stuck, but
report an error later on the post switch which will cause mac80211
to tear down the operation. This ensures nothing gets stuck due to
the scheduling failure.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
