MFC r343240: iwm(4): Fix possible null pointer indirection

MFC r344990:
Fix ieee80211_radiotap(9) usage in wireless drivers:

- Alignment issues:
* Add missing __packed attributes + padding across all drivers; in
most places there was an assumption that padding will be always
minimally suitable; in few places - e.g., in urtw(4) / rtwn(4) -
padding was just missing.
* Add __aligned(8) attribute for all Rx radiotap headers since they can
contain 64-bit TSF timestamp; it cannot appear in Tx radiotap headers, so
just drop the attribute here. Refresh ieee80211_radiotap(9) man page
accordingly.

- Since net80211 automatically updates channel frequency / flags in
ieee80211_radiotap_chan_change() drop duplicate setup for these fields
in drivers.

Revert r324434

Some users are reporting that it is causing issues for their hardware.
In the interest of not breaking stable, revert while we investigate.

Revert MFC of r330463 r330462 r330454 r330452 r330451:

These commits have KPI/KBI considerations (or are a result of those that
do). I did not properly take into account these concerns when merging to
a kbi-stable branch.

Requested by: jhb
Pointyhat to: eadler

MFC r318001:

[iwm] include opt_iwm.h and opt_wlan.h consistently in all files.

MFC r313306:

[iwm] free node reference if rxparams addition fails.

MFC r308185:

[iwm] Set full-offload scan flag. Fixes fw panic when already associated.

* Starting a scan from wpa_supplicant or via ifconfig while associated,
should no longer cause firmware panics or abort early.

Tested:

* AC7260, STA mode

MFC r307158:

net80211: convert all ieee80211_input_mimo*() consumers
to ieee80211_add_rx_params() + drop last (ieee80211_rx_stats) parameter

Note: there is an additional check for ieee80211_get_rx_params()
return value (which does not exist in the original diff).

MFC r306837:

[net80211] extend the ieee80211_rx_stats struct to include more information.

There are a variety of more interesting RX statistics that we should
keep track of but we don't. This is a starting point for adding more
information.

Specifically:

* now the RX rate information and some of the packet status is
passed up;
* The 32 bit or 64 bit TSF is passed up;
* the PHY mode is passed up;
* the "I'm decap'ed AMSDU!" state is passed up;
* number of RX chains is bumped to 4.

This is all mostly a placeholder for getting the data into the RX status
before we pass it up to net80211 - unfortunately we don't yet enforce
that drivers provide it, nor do we pass the provided info back up the
stack so anyone can use the data.

We're going to need to use some of this data moving forward.
Notably, now that some hardware can do AMSDU decap for us (the intel iwm
driver can do it when we flip it on; the ath10k port I'm doing does
it for us) then we need to pass it up through the stack so the duplicate
RX sequence numbers and crypto/IV details don't cause the packet to
be dropped and/or counted against a replay counter.

It's also the beginning of being able to do more interesting node
accounting in net80211. Specifically, once drivers start populating
per-packet rate information, AMPDU information, timestamps, etc,
we can start providing histograms of rate-versus-RSSI, account
for receive time spent per node and other such interesting things.

(Note: I'm also hoping to include ranging and RTT information for
future chipset support; and it's likely going to include it in
this kind of fashion.)

MFC r315924:

[iwm] GC unused code from if_iwm_scan.c, copyied from iwn or iwlwifi/dvm.

Obtained from: dragonflybsd.git 10881df269b93c26e5ee6af629c36db5672e6e52

MFC r327231,r327232:

kernel: Fix several typos and minor errors
lib: Fix several typos and minor errors

- duplicate words
- typos
- references to old versions of FreeBSD

MFC r324434:

Add support for Intel 8265 WiFi

Obtained from: OpenBSD

MFC r321511:

[iwm] Sync rs (rate-selection) API definitions from Linux iwlwifi.

* While there clean up alignments and line wrapping in existing
definitions for rs API in if_iwmreg.h

MFC r321510:

[iwm] Add iwm_mvm_send_lq_cmd() from Linux iwlwifi to if_iwm_util.c.

MFC r321509:

[iwm] Sync statistics API definitions with Linux iwlwifi.

MFC r321508:

[iwm] Cleanup mbufq draining. Add iwm_xmit_queue_drain() like in iwn(4).

* iwm_xmit_queue_drain() calls ieee80211_free_node(), removing a possible
memory leak, compared to using just mbufq_drain().

* Remove duplicate mbufq_drain() from iwm_mvm_rm_sta(), this should be
handled in the caller.

MFC r319589:

[iwm] Remove support for fw older than -17 and -22

* iwm(4) didn't use any of these definitions yet, anyway.

MFC r319582:

[iwm] Ignore IWM_DEBUG_LOG_MSG notifications.

* Firmware versions 21 and 22 generate some IWM_DEBUG_LOG_MSG notifications,
which seem to be harmless. Avoid spamming the system log with
"frame ... UNHANDLED (this should not happen)" messages.

MFC r319581:

[iwm] Set command code for PHY_DB as well.

MFC r319579:

[iwm] Remove dead code from iwm_pcie_load_cpu_sections().

* If device family is 8000 then iwm_pcie_load_cpu_sections()
won't be called at all (iwm_pcie_load_cpu_sections_8000() is
called in that case) so this piece of code never gets called.

MFC r319578:

[iwm] Check for lar_disable tunable, and lar_enabled flag from NVM.

* LAR can be disabled with the hw.iwm.lar.disable tunable now.

* On Family 8000 devices we need to check the lar_enabled flag from
nvm_data in addition to the TLV_CAPA_LAR_SUPPORT flag from the firmware.

* Add a separate IWM_DEBUG_LAR debugging flag.

MFC r318232:

[iwm] Recognize IWM_FW_PAGING_BLOCK_CMD wide cmd response correctly.

MFC r318230:

[iwm] Fix iwm_mvm_send_cmd_pdu(_status) declarations. Make id a uint32_t.

* This fixes cases where the group id of wide commands got lost, e.g. this
happened to the IWM_SCAN_ABORT_UMAC command.

MFC r318231:

[iwm] Revert "if_iwm - SCAN_ABORT_UMAC response doesn't use a wide id"

This reverts commit cef47a9cbb0a3ce5f18369fed9403d2764884bc2.

MFC r318229:

[iwm] Adjust if_iwm_sta.h prototypes, don't pass iwm_node to rm_sta().

* Since a RUN -> INIT/SCAN transition seems to immediately destroy the
ieee80211_node for the AP, we can't read the in_assoc value from there.
Instead just directly pass that information via a boolean_t argument.

* Adds iwm_mvm_rm_sta_id() function, which just unconditionally removes
the station from the firmware.

* The iwm_mvm_rm_sta() function shouldn't actually remove the station from
firmware when we are still associated (i.e. during a RUN -> INIT/SCAN
transition).

* So when disassociating we will first call iwm_mvm_rm_sta() to drain the
queues/fifos. Later during disassociation we will then use
iwm_mvm_rm_sta_id() to actually remove the station.

Inspired-By: Linux iwlwifi

MFC r318224:

[iwm] Refuse connection to APs with beacon interval < 16.

MFC r318223:

[iwm] Handle AUTH->SCAN/INIT and ASSOC->SCAN/INIT better

* Tear down the relevant firmware state (i.e. the station, the vif binding)
in these transition cases.

* Before this case would leave the firmware state lying around, resulting
in errors and firmware panics in the subsequent association attempts.

MFC r318222:

[iwm] Factor out firmware station handling into if_iwm_sta.c.

* This adds iwm_mvm_rm_sta(), which will be used to tear down firmware
state for better/cleaner iwm_newstate() handling.

* Makes iwm_enable_txq() and iwm_mvm_flush_tx_path() non-static, add
the declarations to if_iwm_util.h for now.

MFC r318219:

[iwm] Properly implement iwm_wme_update callback function.

* Inspired by iwn(4) and Linux iwlwifi.

* Read wme parameters into a buffer within struct iwm_vap in
iwm_wme_update().

* If we aren't associated yet, the new settings will soon be sent
by iwm_mvm_mac_ctxt_changed() during association.

* If we are already associated, explicitly call iwm_mvm_mac_ctxt_changed()
from iwm_wme_update() to send the new settings to the firmware.

* Change iwm_mvm_ac_to_tx_fifo mapping, to fit the freebsd net80211
WME stream class numbering, instead of Linux's enum ieee80211_ac_numbers.

MFC r318218:

[iwm] Process multiple frames per RX buffer.

* Factor out iwm_handle_rxb() function from iwm_notif_intr().

* Removing the IWM_FH_RCSR_CHNL0_RX_CONFIG_SINGLE_FRAME_MSK flag allows
the device to put multiple frames (both command responses and 80211
frames) into a single RX buffer.

* Uses m_copym() to split up the receive buffers when multiple 80211
frames are received in one RX buffer. The effect is basically the same
as when using m_split(), but we want to keep the original mbuf around
when calling iwm_mvm_rx_rx_mpdu() to make error handling a bit easier
for now.

* Contains a small optimization to avoid the m_copym() when only a single
80211 frame is received in one RX buffer (i.e. matching the existing
behaviour).

MFC r318217:

[iwm] Change UCODE_TLV_API #define-s from bitmasks to indexes.

* Fixes oversight from commit 757eecf0e6c92745aa2eee95811e573c8300850e.
fw_has_api now uses the isset macro instead of a simple logical-and.

MFC r318216:

[iwm] Sync iwm_read_firmware()'s loop to iwlwifi's code.

MFC r318215:

[iwm] change the check for ADD_STA status, use IWM_ADD_STA_STATUS_MASK.

MFC r318214:

[iwm] Sanity check channel for IEEE80211_CHAN_ANYC in if_iwm_mac_ctxt.c.

* This avoids panicing in some broken vap state handling cases.

MFC r318013:

[iwm] Move in_phyctxt from struct iwm_node to phy_ctxt in struct iwm_vap.

* This better matches how things are organized in Linux's iwlwifi.

MFC r318012:

[iwm] Allow listening on both chains/atennas to get diversity.

This might improve throughput slightly when far from the accesspoint,
apparently by allowing the firmware to listen on either of the two
antennas (if there are two, i.e. on 7260/7265/8260), whichever has
a better reception.

MFC r318005:

[iwm] Add basic powermanagement support via ifconfig wlan0 powersave.

* The DEVICE_POWER_FLAGS_CAM_MSK flag was removed in the upstream iwlwifi
in Linux commit ceef91c89480dd18bb3ac51e91280a233d0ca41f.

* Add sc_ps_disabled flag to struct iwm_softc, which corresponds to
mvm->ps_disabled in struct iwl_mvm in Linux iwlwifi.

* Adds a hw.iwm.power_scheme tunable which corresponds to the power_scheme
module parameter in Linux iwlwifi. Set this to 1 for completely
disabling power management, 2 (default) for balanced powermanagement,
and 3 for lowerpower mode (which does dtim period skipping).

* Imports the constants.h file from iwlwifi as if_iwm_constants.h.

* This doesn't allow changing the powermanagement setting while connected,
also one can only choose between enabled and disabled powersaving with
ifconfig (so switching between balanced and low-power mode requires
rebooting to change the tunable).

* After any changes to powermanagement (i.e. "ifconfig wlan0 powersave" to
enable powermanagement, or "ifconfig wlan0 -powersave" for disabling
powermanagement), one has to disconnect and reconnect to the accespoint
for the change to take effect.

MFC r318003:

[iwm] Add iwm_nic_unlock() calls missing from previous commit.

MFC r318002:

[iwm] iwm_{read,write}_prph() don't grab the nic lock in iwm themselves.

* Fix a couple of cases where the nic lock ended up not being grabbed
during an iwm_read_prph() or iwm_write_prph().

MFC r315926:

[iwm] Add the BSS's basic rates to iwm's LQ command, not all the rates.

Makes the firmware use appropriate Tx rates for ACKs.

MFC r315923:

[iwm] Tiny cleanup in iwm_rx_addbuf().

MFC r315784:

[iwm] Make ucode capabilities and api flags handling more like iwlwifi.

MFC r315780:

[iwm] Remove a couple of unneeded IWM_UCODE_TLV_FLAGS_* flags.

* All the supported firmwares have these flags set.

* This removes the following flags:
IWM_UCODE_TLV_FLAGS_PM_CMD_SUPPORT,
IWM_UCODE_TLV_FLAGS_NEWBT_COEX,
IWM_UCODE_TLV_FLAGS_BF_UPDATED,
IWM_UCODE_TLV_FLAGS_D3_CONTINUITY_API,
IWM_UCODE_TLV_FLAGS_STA_KEY_CMD,
IWM_UCODE_TLV_FLAGS_DEVICE_PS_CMD,
IWM_UCODE_TLV_FLAGS_SCHED_SCAN,
IWM_UCODE_TLV_FLAGS_RX_ENERGY_API,
IWM_UCODE_TLV_FLAGS_TIME_EVENT_API_V2

* Also remove definitions and code for dealing with the v1 time-event api.

* Remove unneeded calc_rssi() function.

MFC r315778:

[iwm] Move mbuf hacks after sanity checks in iwm_mvm_rx_rx_mpdu().

* This avoids leaving the mbuf in a weird state, when dropping a packet.

MFC r315777:

[iwm] Get rid of struct iwm_rx_data argument for iwm_mvm_rx_rx_mpdu.

MFC r314192,r314209:

[iwm] Add support for Firmware paging, needed for newer 8000C firmware.

* Uses the IWM_FW_PAGING_BLOCK_CMD firmware command to tell the firmware
what memory ranges to use for paging.

MFC r314082:

[iwm] Move iwm_dma_contig_alloc/_free functions to if_iwm_util.c.

MFC r314081:

[iwm] Switch 7265D and 3165 devices to 7265D firmware.

MFC r314076:

[iwm] Move struct iwm_cfg chipset configs to if_iwm_7000.c and _8000.c

* This is more similar to how code/definitions are distributed in
Linux's iwlwifi.

* This should make recognizing new chipset variants, and adding additional
flags from the Linux iwlwifi code easier, without blowing up if_iwm.c

MFC r314074:

[iwm] Simplify device id matching code a bit.

* Just add the struct iwm_cfg pointers to the iwm_devices array, to get
rid of the large switch clause.

MFC r314070:

[iwm] Fix typo in commit a7697ea01c11fd493aec52260a02f31df680eb91.

* The sc->sc_uc.uc_error_event_table value is now at sc->error_event_table,
and not sc->umac_error_event_table.

MFC r314069:

[iwm] Get rid of unneeded IWM_FWDMASEGSZ and IWM_FWMAXSIZE constants

* We only need IWM_FH_MEM_TB_MAX_LENGTH bytes for the fw_dma memory.

MFC r314067:

[iwm] With the previous commits, this DELAY no longer seems to be needed.

MFC r314066:

[iwm] Sync IWM_MVM_ALIVE waiting and start_fw handling with iwlwifi.

* Use the notification wait API, like it's done in the Linux iwlwifi code,
to wait for the IWM_MVM_ALIVE notification.

* This also should fix some firmware load interrupt issues, and errors
in the nic lock using.

Tested:

* (adrian) Intel 7260, STA mode

MFC r314065:

[iwm] Synchronize firmware loading code with Linux iwlwifi.

* While there, rename some functions to match the names and functionality
of the similarly named functions in Linux iwlwifi.

MFC r313430:

[iwm] Remove 1s delay after fw loading. Can't reproduce issues on AC8260.

The 1s delay was added in the update to version 16 fw, where Family 8000
support was added.

MFC r313429:

[iwm] SCAN_ABORT_UMAC response doesn't use a wide id

MFC r313427:

[iwm] Recognize the IWM_UCODE_TLV_FW_MEM_SEG firmware section type.

* Will be needed for loading version 22 of 7265D firmware.

MFC r313418:

[iwm] Recognize IWM_DTS_MEASUREMENT_NOTIF_WIDE notification.

* Add the command groups enum, and the iwm_phy_ops_subcmd_ids enum
to if_iwmreg.h definitions.

* The IWM_DTS_MEASUREMENT_NOTIF_WIDE notification will be generated by
version 17 firmware.

Taken-From: Linux iwlwifi

MFC r313417:

[iwm] Very basic DTS thermal sensor support (prints temp as debug msg).

* Adds IWM_DEBUG_TEMP debug message type, for printing messages related
to temperature sensors and thermal/TDP infos.

* The firmware regularly sends us DTS measurement notifications, so just
print the temperature value as a debugging message.

(Adrian's addition):

* Eventually this can be used by the driver to limit transmit rate / power to
try and do some thermal throttling.

MFC r313416:

[iwm] Only for family 7000 power-down busmaster DMA clocks when stopping.

MFC r313415:

[iwm] Implement apmg_wake_up_wa workaround properly for 7000 family.

* Add iwm_pcie_set_cmd_in_flight() and iwm_pcie_clear_cmd_in_flight()
helper methods.

* Use ring->queued tracking in the command queue to set/clear the
cmd_hold_nic_awake bit at the right points.

MFC r313414:

[iwm] Use iwm_mvm_scan_stop_wait to properly abort scans.

* Add IWM_FLAG_SCAN_RUNNING to sc->sc_flags to track whether the firmware
is currently running a scan, in order to decide wheter iwm_scan_end
needs to abort a running scan.

* In iwm_scan_end, if the scan is still running, we now abort it, in order
to keep the firmware scanning state in sync.

* Try to make things a bit simpler, by reacting on the
IWM_SCAN_OFFLOAD_COMPLETE and IWM_SCAN_COMPLETE_UMAC notifications,
instead of IWM_SCAN_ITERATION_COMPLETE and
IWM_SCAN_ITERATION_COMPLETE_UMAC. This should be fine since we always
only tell the firmware to do a single scan iteration anyway.

MFC r313413:

[iwm] Add scan abort functions, to properly cancel a running scan.

* Uses the notification wait api to wait for the corresponding scan
complete notification after sending the abort command.

MFC r313412:

[iwm] Get rid of iwm_disable_rx_dma, just use iwm_pcie_rx_stop directly.

* This also fixes one of many small nic lock handling bugs, and matches
iwlwifi's code.

MFC r313325:

[iwm] Use notification wait API to wait for calibration to complete.

Tested:

* 7260, STA mode (2g, 5g)

MFC r313322,r313354:

[iwm] Add implementation of the notification wait api from iwlwifi.

MFC r313317:

[iwm] Change 2nd arg of iwm_phy_db_set_section() to struct iwm_rx_packet.

* This matches the function declaration in Linux's iwlwifi.

MFC r313315,r313316:

[iwm] Get rid of some gratuitous constant renaming wrt. Linux iwlwifi.

* IWM_UCODE_SECT_MAX -> IWM_UCODE_SECTION_MAX

* IWM_UCODE_TYPE_* -> IWM_UCODE_* (except for IWM_UCODE_TYPE_MAX which
stays).

[iwm] Store paging_mem_size field in firmware image information struct.

MFC r313314:

[iwm] Sync valid_tx_ant and valid_rx_ant mask handling with iwlwifi.

* This fixes the phy_cfg field sent in the iwm_send_phy_cfg_cmd()
command, which wasn't taking into account the valid_rx_ant and
valid_tx_ant masks from nvm_data before.

Tested:

* 7260, STA mode, 2G and 5G

MFC r313312:

[iwm] Use chipset configuration structs like iwlwifi does.

* This makes it a bit easier to factor out common parts for e.g. the
7000 chipset family.

* Add iwm7265d config, and recognize the 7265D chipset variant via the
hardware revision.

Tested:

* 7260, STA mode (2ghz)

MFC r313311:

[iwm] Sync nvm parsing code with Linux iwlwifi.

* sc->sc_nvm becomes sc->nvm_data and is now a pointer instead of an
inlined struct.

* Add sc->eeprom_size and sc->nvm_hw_section_num configuration values to
struct iwm_softc.

* For now continue to avoid negative error return-values, and use pointer
variables for some return values, as before.

* Continue to omit LAR (location aware regulatory) related code as well.

Tested:

* Intel 7260, STA mode (2GHz)

MFC r313310:

[iwm] make sure we call iwm_detach_local() only once.

MFC r313309:

[iwm] Sync if_iwm_phy_db code with Linux iwlwifi.

MFC r313308:

[iwm] The HW Revision stepping constants should be in if_iwmreg.h.

MFC r313307:

[iwm] TODO for QOS support.

MFC r308777:

[iwm] Sync iwm_nvm_read_chunk() function with Linux iwlwifi.

This fixes an error handling detail in iwm_nvm_read_chunk(), where an
error response from the firmware for an NVM read shouldn't be fatal if
the offset was non-zero.

MFC r308577:

iwm: If firmware load fails during init via iwm_preinit() we bail out
before calling ieee80211_ifattach() so the taskqueue hasn't been
initialized. Don't try to drain it, we'll panic.
Looks like this issue was introduced in r303326.

MFC r308183:

[iwm] Get rid of SYNC_RESP_STRUCT and SYNC_RESP_PTR macros.

* SYNC_RESP_STRUCT and SYNC_RESP_PTR originate from the OpenBSD version of
iwm, and they weren't serving any real purpose in the FreeBSD port.

* We just do a single bus_dmamap_sync for syncing the complete received frame,
instead of explicitly bus_dmamap_sync-ing subranges of the frame like in
the OpenBSD iwm code.

MFC r306900:

iwm: add missing 'Rx errors' counter incrementation.

MFC r306286:

[iwm] fix default antenna selection a bit; fix 5GHz rate control handling.

* Don't do the antenna switching when setting up the rate table - we don't
take into account whether it's an active antenna or not (eg shared with BT.)
I'll look into this a bit more later.

* The default antenna is still 1, I'll look into that a bit more later.
(So no, this doesn't fix it for Larry who needs ANT_B to be active, not
ANT_A.)

* My changes to the rate control setup used the wrong method for finding
a suitable rate, which led to 1M CCK frames being queued for 11a operation.
This is .. sub-optimal. Change the rate control lookup path to use
the global table instead of the per-node table, which won't be setup
until the node rate table is setup (which happens way too late in this
game.)

Tested:

* Intel 7260, 2G and 5G operation.

MFC r306142:

[iwm] use rate control info from the node txrates; use mgmtrate for EAPOL frames

This changes the transmit rate control code to do a few things:

* use fixed rates (mcast, ucast, mgmt) where required.
* Don't use a hard-coded 11a or 11bg rate for non-data frames -
use what net80211 says we should use.
* use mgmtrate for EAPOL frames.

MFC r306007:

[iwm] Improve reliability of iwm_release on disassociation a bit.

* We need to first call ivp->iv_newstate(), to enqueue the deauth/deassoc
mgmt frame, then flush the tx queue, before actually calling
iwm_release().

* cycling a wlan connection via wpa_cli frontend to wpa_supplicant, by
issuing disconnect and reconnect commandos works quite well.
(There is still an issue when disconnecting/reconnecting too quickly)

* Reassociating or roaming via wpa_supplicant is still broken.

MFC r306005:

[iwm] Remove dead fw_totlen from struct iwm_fw_sects; clean up struct iwm_nvm_data.

* No functional change, none of these values were ever read.

* The values removed from struct iwm_nvm_data are only used for old dvm
devices in Linux iwlwifi, and irrelevant to iwm hence.

MFC r306005:

[iwm] Use IWM_DEFAULT_SCAN_CHANNELS define as default for sc_capa_n_scan_channels.

MFC r306004:

[iwm] Remove deprecated scan API definitions.

* This removes deprecated scan API definitions, which have been unused
since the upgrade to version 16 firmware in change r303327.

* Part of this change matches the header-file changes in Linux git commit
1f9403863c080478ad78247c89b018e95bdfb027.

* No functional change.

MFC r30600

[iwm] Remove wrappers around iwm_dma_contig_free() calls.

No functional changes.

MFC r306002

[iwm] Fix iwm_poll_bit() error value check in iwm_attach().

The iwm(4) iwm_poll_bit() function returns 1 on success, and 0 on failure,
whereas the iwl_poll_bit() in Linux iwlwifi returns < 0 on failure.

So the (ret < 0) check ended up ignoring any error returned by
iwm_poll_bit().

MFC r306001

[iwm] Fix off-by-one check in iwm_read_firmware().

This fixes a potential buffer overrun in the firmware parsing code.

MFC r306000

[iwm] Remove unused field from iwm_rx_data. Use uint32_t instead of enum type.

The wantresp field in struct iwm_rx_data has never been used for anything,
so we can just delete it.

Apparently struct iwm_sf_cfg_cmd was compiled correctly (using a 32bit
value to represent the enum), but it still seems like a very bad idea to use
an enum type in a __packed struct.

MFC r305999:

[iwm] Use htole16 for policy field in struct iwm_time_event_cmd_v2.

The htole32 was working fine for little-endian machines, but would
have been broken on big-endian.

MFC r305917:

[iwm] fix up RSSI calculations for both scan results and normal RX
operations.

* hard code a noise floor of -96 for now. The noise floor update
* code returns
some "interesting" values that I can't map to anything useful
right now.
* Ensure a default noise floor is set - otherwise the initial
* scan results
have a noise floor of '0'.
* Fix up the RSSI calculation to be correctly relative
* to the noise floor.
The RSSI routines return an absolute value in dBm -
so fix this up.
* Cap RSSI values appropriately.
* Ensure we pass in a 1/2 dB unit value in to
* net80211.

MFC r304891:

iwm: fix few comment typos.

MFC r304880:

iwm: add 'command accepted' debug notification (copied from wpi(4)).

Now it should be easier to find out which command causes firmware
panics when few commands are sent in a short period of time.

MFC r314073:

[iwm] Remove OpenBSD-specific comment. Beautify pci cfg space
accesses.

MFC r305470:

iwm: fix scanning for hidden SSIDs.

Setup SSIDs in scan command so firmware will send direct probe request(s)
while scanning.

Tested by: dbkirk@gmail.com

PR: 211519

MFC r303322,303326,303327,303345,303413,303416,303418,303557

Update iwm(4) and iwmfw(4) to current in order to stabilize and improve
functionality.

Approved by: re (gjb)

Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

[iwm] Use mbuf for large firmware commands, like OpenBSD does.

We also need to consider the size of large firmware commands in iwm_alloc_tx_ring(),
in the dma tag creation, when qid == IWM_MVM_CMD_QUEUE. The old code apparently
only allocated a 2KB (MCLBYTES) sized buffer when it actually expected 4KB.

Submitted by: Imre Vadasz <imre@vdsz.com>
Approved by: re (gjb)
Differential Revision: https://reviews.freebsd.org/D6824

[iwm] Add and use iwm_phy_db_free(), to plug phy_db memory leak.

(Together with other iwm(4) memory leak fixes) Memory leakage in M_DEVBUF
is now at ca. 2KB for each iwm(4) module load/unload cycle.

Submitted by: Imre Vadasz <imre@vdsz.com>
Approved by: re (gjb)
Obtained from: DragonflyBSD git eaf551a1d464c643e98ce5781971dd32124e9af1
Differential Revision: https://reviews.freebsd.org/D6819

[iwm] Fix iwm_dma_contig_free(). dma->map is always NULL here.

* When bus_dmamem_alloc is used, the bus_dmamap_t is usually set to NULL, so
we were never actually freeing any dma memory allocations done via
iwm_dma_contig_alloc(). So we should check dma->vaddr instead of dma->map here.

* Also, the dmamap is actually supposed to be invalidated as part of
bus_dmamem_free(), so bus_dmamap_destroy() is never needed here.

Submitted by: Imre Vadasz <imre@vdsz.com>
Approved by: re (gjb)
Obtained from: DragonflyBSD git ef2b29a7ba6ca8a9d2c82ab591c0622227ff84cb

[iwm] Use vap->iv_myaddr instead of ic->ic_macaddr when vap != NULL.

ic_macaddr is only used for the initial mac address provided by NVM. We should
rather use vap->iv_myaddr when vap != NULL, to allow the MAC address
to be changed later with ifconfig(8).

Submitted by: Imre Vadasz <imre@vdsz.com>
Reviewed by: avos
Approved by: re (gjb)
Obtained from: DragonflyBSD git 4aee7a78275676d22d14c04177bd0c9377d91478
Differential Revision: https://reviews.freebsd.org/D6743

[iwm] free RX ring / NVM memory after they're used.

* Free RX ring during detach
* Free NVM memory after parsing

Tested:

* 7260, STA mode

Submitted by: Imre Vadasz <imre@vdsz.com>
Approved by: re (gjb)
Obtained from: dragonflybsd
Differential Revision: https://reviews.freebsd.org/D6817

[iwm] Fix up busdma use in the RX path

When allocating a new mbuf or bus_dmamap_load()-ing it fails,
we can just keep the old mbuf since we are dropping that packet anyway.
Instead of doing bus_dmamap_create() and bus_dmamap_destroy() all the time,
create an extra bus_dmamap_t which we can use to safely try
bus_dmamap_load()-ing the new mbuf. On success we just swap the spare
bus_dmamap_t with the data->map of that ring entry.

Tested:

Tested with Intel AC7260, verified with vmstat -m that new kernel no
longer visibly leaks memory from the M_DEVBUF malloc type.
Before, leakage was 1KB every few seconds while ping(8)-ing over the wlan
connection.

Submitted by: Imre Vadasz <imre@vdsz.com>
Approved by: re@
Obtained from: DragonflyBSD.git cc440b26818b5dfdd9af504d71c1b0e6522b53ef
Differential Revision: https://reviews.freebsd.org/D6742

[iwm] valid_{tx,rx}_ant from radio_cfg is only needed for 8000 family.

* The "if (!data->valid_tx_ant || !data->valid_rx_ant) {" check was getting
triggered with a 3165 chipset.

Submitted by: Imre Vadasz <imre@vdsz.com>
Obtained from: DragonflyBSD 3655dfb6fc311fc83e5ce8370dd91b4cd4a37991

[iwm] Fix several nitpicks in iwm(4).

Move some declarations to if_iwmreg.h.
Remove iwm_fw_alive(); just call iwm_post_alive() directly.
Simplify iwm_mvm_add_sta().
Return timeout error from iwm_apm_init().
Print a message when init (i.e. boot) firmware fails to load.
Remove some commented-out code which wouldn't compile anyway.
Move iwm_mvm_tx_fifo to if_iwmreg.h to match better where Linux puts it.

Taken-From: OpenBSD (if_iwm.c r1.80 and if_iwmreg.h r1.11)

Submitted by: Imre Vadasz <imre@vdsz.com>
Obtained from: DragonflyBSD 29fcb331e5620ae145a6ab9cdda830e22fff626a

[iwm] Add bit-polling in Rx-DMA init code path.

Taken-From: OpenBSD (if_iwm.c r1.80)

Submitted by: Imre Vadasz <imre@vdsz.com>
Obtained from: DragonflyBSD ed35558754288911048cb607e57c688273ebd8d4

[iwm] Clean up iwm(4) scanning logic a bit.

Submitted by: Imre Vadasz <imre@vdsz.com>
Obtained from: DragonflyBSD 8f3ffab9136e33263d424275ec28f57ad2096437

[iwm] Use IWM_MAX_CMD_PAYLOAD_SIZE to improve command length checks.

Taken-From: OpenBSD (parts of if_iwm.c r1.57 and if_iwmreg.h r1.10)

Obtained from: DragonflyBSD b70c1eaad06257c5c7f4d8110d21642ebec14f42

[iwm] add LED blinking for iwm hardware that supports it.

Submitted by: Imre Vadasz <imre@vdsz.com>
Obtained from: DragonflyBSD, Linux iwlwifi/mvm

[iwm] remove dead code.

if_iwm - GC some dead code, left by a partially applied OpenBSD change.

Taken-From: OpenBSD (if_iwm.c r1.69)

Submitted by: Imre Vadasz <imre@vdsz.com>
Obtained from: DragonflyBSD git 07dfed32ea39b980b0b80d27ff938e7c3ca4c0b5

iwm: add 'opt_wlan.h' include into source files.

Include net80211 options file, so IEEE80211_DEBUG_REFCNT option will be
handled correctly.

iwm: restart device after watchdog timeouts.

Don't repeat the the word 'the'

(one manual change to fix grammar)

Confirmed With: db
Approved by: secteam (not really, but this is a comment typo fix)

Follow-up r298818: hide size of 'bands' array behind a macro.

sys/dev: minor spelling fixes.

Most affect comments, very few have user-visible effects.

iwm: fix parameters for iwm_add_channel_band()

It accepts <first index, max index + 1>, not
<first index, number of entries>.

Reported by: adrian

iwm: switch to ieee80211_add_channel()

- Switch to ieee80211_add_channel().
- Parse/set more channel flags (DFS, NOADHOC).
- Add ic_getradiocaps() method.

Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D6150

[iwn] fill in the TX command rate info flags consistently.

The Linux driver sets the rate_n_flags regardless of whether it's being
sent using firmware rate control or local rate control. This includes
the antenna configuration.

Thanks to Kyle Evans <kevans91@ksu.edu> for pointing this out to me
and doing some investigation/testing on his end.

Tested:

* Intel 7260 STA, 2G and 5G networks

The iwm_nic_error() defined if IWM_DEBUG is defined.

iwm(4): Don't dereference potentially NULL pointer before NULL check

Introduced in r298594. There is no path before the 'vap == NULL' check where
vap is not already dereferenced.

Reported by: Coverity
CID: 1354979
Sponsored by: EMC / Isilon Storage Division

[iwm] implement suspend/resume through ieee80211_{suspend,resume}_all

This allows wifi to associate correctly after a suspend/resume cycle.

Yes, I'm using this now day to day.

Tested:

* Intel 7260AC, STA mode

[iwm] add extra transmit setup/completion logging so I can see what's going on.

I'm seeing 5GHz association work but data not work until the rate drops,
so I need way more information about what's being programmed into the
transmit descriptors.

Tested:

* 7260AC, STA mode

[iwm] restart the VAP if there's a firmware panic.

Always print out the firmware panic info before restarting; don't
put it behind IWM_DEBUG.

Submitted by: bapt
Differential Revision: https://reviews.freebsd.org/D6081

[iwn] fix firmware command use in iwm_auth().

The iwm firmware has separate commands for add, modify and delete for
various things (mac, phy context, etc.) The openbsd driver has a habit
of just completely resetting the NIC each time, which is technically
mostly okay (as long as the reset doesn't actually fail!) but it means
a lot of the code is doing ADD when it should do MODIFY.

The firmware responds in kind - it just asserts.

This fixes auth attempts that occur after the NIC has been already
configured.

(I'm sure there are more instances of this!)

Tested:

iwm0: <Intel Dual Band Wireless AC 7260> mem 0xf1400000-0xf1401fff irq 17 at device 0.0 on pci2
iwm0: revision: 0x140, firmware 25.228 (API ver. 9)

.. STA mode.

Submitted by: Masachika ISHIZUKA <ish@amail.plala.or.jp>

[iwm] fix up the rate control setup code to initialise rates in the order
we want to use it.

The rate table was being initialised in low->high, but the link quality
table was being initialised high->low. So, when we did a lookup, we
would get the indexes wrong.

This started by a patch from dragonflybsd which reversed how the ni->in_ridx[]
array is being used; I'd rather it all be consistent. So, this is consistent.

Inspired by: what I did to iwn(4) a while ago
Inspired by: DragonflyBSD; <imre@vdsz.com>

iwm: revert r293178

This optimization is not proper (and causes kernel panic),
since driver checks fw_status to optimize away parsing stage
if it was already done.

Reported by: dchagin

iwm: free firmware related resources after uploading it to the hardware

iwn(4) / wpi(4) works in the same way
(read_firmware() -> hw_init() -> firmware_put())

Approved by: adrian (mentor)
Differential Revision: https://reviews.freebsd.org/D4766

iwm: store pointer for 'struct firmware' instead of
'size_t' and 'void *' pair.

Approved by: adrian (mentor)
Obtained from: DragonFlyBSD
Differential Revision: https://reviews.freebsd.org/D4765

iwm: use m_collapse() to defragment a mbuf chain

- Simplify defragmentation code.
- Use proper number of dma segments for data.

Approved by: adrian (mentor)
Obtained from: DragonFlyBSD (mostly)
Differential Revision: https://reviews.freebsd.org/D4754

iwm: convert to ieee80211_tx_complete()

Approved by: adrian (mentor)
Differential Revision: https://reviews.freebsd.org/D4755

iwm: reorganize if_iwmvar.h

- Change order of data in if_iwmvar.h
(like it is in other drivers: defines, data structures,
vap/node structures, softc struct and locks); use indentation.
- Fix IWM_LOCK(_sc) / IWM_UNLOCK(_sc) macro.
- Add IWM_LOCK_INIT / DESTROY(sc) + fix mtx_init() usage.
- Wrap iwm_node casts into IWM_NODE() macro.
- Drop some fields:
* wt_hwqueue from Tx radiotap header;
* macaddr[6] from iwm_vap;

Approved by: adrian
Differential Revision: https://reviews.freebsd.org/D4753

Fix IEEE80211_ADDR_COPY() usage.

Reviewed by: adrian

Remove BUS_DMA_NOWAIT from bus_dma_tag_create() invocations as it's
no valid flag there.

net80211 drivers: eliminate any references to sc_rxtap_len/sc_txtap_len (never used here)

Submitted by: <s3erios@gmail.com>
Differential Revision: https://reviews.freebsd.org/D3776

net80211: move ieee80211_free_node() call on error from ic_raw_xmit() to ieee80211_raw_output().

This doesn't free the mbuf upon error; the driver ic_raw_xmit method is still
doing that.

Submitted by: <s3erios@gmail.com>
Differential Revision: https://reviews.freebsd.org/D3774

Ensure the ring state is also blanked upon reset, otherwise
duplicate rx events get handled during reset paths.

Submitted by: Matthew Dillion <dillon@apollo.backplane.com>
Obtained from: DragonflyBSD

Replay r286410. Change KPI of how device drivers that provide wireless
connectivity interact with the net80211 stack.

Historical background: originally wireless devices created an interface,
just like Ethernet devices do. Name of an interface matched the name of
the driver that created. Later, wlan(4) layer was introduced, and the
wlanX interfaces become the actual interface, leaving original ones as
"a parent interface" of wlanX. Kernelwise, the KPI between net80211 layer
and a driver became a mix of methods that pass a pointer to struct ifnet
as identifier and methods that pass pointer to struct ieee80211com. From
user point of view, the parent interface just hangs on in the ifconfig
list, and user can't do anything useful with it.

Now, the struct ifnet goes away. The struct ieee80211com is the only
KPI between a device driver and net80211. Details:

- The struct ieee80211com is embedded into drivers softc.
- Packets are sent via new ic_transmit method, which is very much like
the previous if_transmit.
- Bringing parent up/down is done via new ic_parent method, which notifies
driver about any changes: number of wlan(4) interfaces, number of them
in promisc or allmulti state.
- Device specific ioctls (if any) are received on new ic_ioctl method.
- Packets/errors accounting are done by the stack. In certain cases, when
driver experiences errors and can not attribute them to any specific
interface, driver updates ic_oerrors or ic_ierrors counters.

Details on interface configuration with new world order:
- A sequence of commands needed to bring up wireless DOESN"T change.
- /etc/rc.conf parameters DON'T change.
- List of devices that can be used to create wlan(4) interfaces is
now provided by net.wlan.devices sysctl.

Most drivers in this change were converted by me, except of wpi(4),
that was done by Andriy Voskoboinyk. Big thanks to Kevin Lo for testing
changes to at least 8 drivers. Thanks to pluknet@, Oliver Hartmann,
Olivier Cochard, gjb@, mmoll@, op@ and lev@, who also participated in
testing.

Reviewed by: adrian
Sponsored by: Netflix
Sponsored by: Nginx, Inc.

Convert more ifp->if_softc -> ic->ic_softc.

These should be a big no-op.

Tested:

* make universe

iwm: use the proper include path for iwm headers.

iwm: fix a KASSERT: s/ds_size/ds_len/.

Import OpenBSD's iwm WiFi driver for Intel 3160/7260/7265.

There are still several bugs, but I've been using it for a while now.
Thanks to all the testers and to Adrian for his help with this
driver.

This driver isn't connected to the build yet, but it will be soon.

There's no MFC planned because the driver isn't very stable yet.

Reviewed by: adrian
Obtained from: https://github.com/rpaulo/iwm
Tested by: adrian, gjb, dumbbell (others that I forgot).
Relnotes: yes