MFC r343240: iwm(4): Fix possible null pointer indirection

Revert r324434

Some users are reporting that it is causing issues for their hardware.
In the interest of not breaking stable, revert while we investigate.

Revert MFC of r330463 r330462 r330454 r330452 r330451:

These commits have KPI/KBI considerations (or are a result of those that
do). I did not properly take into account these concerns when merging to
a kbi-stable branch.

Requested by: jhb
Pointyhat to: eadler

MFC r318001:

[iwm] include opt_iwm.h and opt_wlan.h consistently in all files.

MFC r313306:

[iwm] free node reference if rxparams addition fails.

MFC r308185:

[iwm] Set full-offload scan flag. Fixes fw panic when already associated.

* Starting a scan from wpa_supplicant or via ifconfig while associated,
should no longer cause firmware panics or abort early.

Tested:

* AC7260, STA mode

MFC r307158:

net80211: convert all ieee80211_input_mimo*() consumers
to ieee80211_add_rx_params() + drop last (ieee80211_rx_stats) parameter

Note: there is an additional check for ieee80211_get_rx_params()
return value (which does not exist in the original diff).

MFC r306837:

[net80211] extend the ieee80211_rx_stats struct to include more information.

There are a variety of more interesting RX statistics that we should
keep track of but we don't. This is a starting point for adding more
information.

Specifically:

* now the RX rate information and some of the packet status is
passed up;
* The 32 bit or 64 bit TSF is passed up;
* the PHY mode is passed up;
* the "I'm decap'ed AMSDU!" state is passed up;
* number of RX chains is bumped to 4.

This is all mostly a placeholder for getting the data into the RX status
before we pass it up to net80211 - unfortunately we don't yet enforce
that drivers provide it, nor do we pass the provided info back up the
stack so anyone can use the data.

We're going to need to use some of this data moving forward.
Notably, now that some hardware can do AMSDU decap for us (the intel iwm
driver can do it when we flip it on; the ath10k port I'm doing does
it for us) then we need to pass it up through the stack so the duplicate
RX sequence numbers and crypto/IV details don't cause the packet to
be dropped and/or counted against a replay counter.

It's also the beginning of being able to do more interesting node
accounting in net80211. Specifically, once drivers start populating
per-packet rate information, AMPDU information, timestamps, etc,
we can start providing histograms of rate-versus-RSSI, account
for receive time spent per node and other such interesting things.

(Note: I'm also hoping to include ranging and RTT information for
future chipset support; and it's likely going to include it in
this kind of fashion.)

MFC r324434:

Add support for Intel 8265 WiFi

Obtained from: OpenBSD

MFC r321510:

[iwm] Add iwm_mvm_send_lq_cmd() from Linux iwlwifi to if_iwm_util.c.

MFC r321509:

[iwm] Sync statistics API definitions with Linux iwlwifi.

MFC r321508:

[iwm] Cleanup mbufq draining. Add iwm_xmit_queue_drain() like in iwn(4).

* iwm_xmit_queue_drain() calls ieee80211_free_node(), removing a possible
memory leak, compared to using just mbufq_drain().

* Remove duplicate mbufq_drain() from iwm_mvm_rm_sta(), this should be
handled in the caller.

MFC r319589:

[iwm] Remove support for fw older than -17 and -22

* iwm(4) didn't use any of these definitions yet, anyway.

MFC r319582:

[iwm] Ignore IWM_DEBUG_LOG_MSG notifications.

* Firmware versions 21 and 22 generate some IWM_DEBUG_LOG_MSG notifications,
which seem to be harmless. Avoid spamming the system log with
"frame ... UNHANDLED (this should not happen)" messages.

MFC r319581:

[iwm] Set command code for PHY_DB as well.

MFC r319579:

[iwm] Remove dead code from iwm_pcie_load_cpu_sections().

* If device family is 8000 then iwm_pcie_load_cpu_sections()
won't be called at all (iwm_pcie_load_cpu_sections_8000() is
called in that case) so this piece of code never gets called.

MFC r319578:

[iwm] Check for lar_disable tunable, and lar_enabled flag from NVM.

* LAR can be disabled with the hw.iwm.lar.disable tunable now.

* On Family 8000 devices we need to check the lar_enabled flag from
nvm_data in addition to the TLV_CAPA_LAR_SUPPORT flag from the firmware.

* Add a separate IWM_DEBUG_LAR debugging flag.

MFC r318232:

[iwm] Recognize IWM_FW_PAGING_BLOCK_CMD wide cmd response correctly.

MFC r318231:

[iwm] Revert "if_iwm - SCAN_ABORT_UMAC response doesn't use a wide id"

This reverts commit cef47a9cbb0a3ce5f18369fed9403d2764884bc2.

MFC r318229:

[iwm] Adjust if_iwm_sta.h prototypes, don't pass iwm_node to rm_sta().

* Since a RUN -> INIT/SCAN transition seems to immediately destroy the
ieee80211_node for the AP, we can't read the in_assoc value from there.
Instead just directly pass that information via a boolean_t argument.

* Adds iwm_mvm_rm_sta_id() function, which just unconditionally removes
the station from the firmware.

* The iwm_mvm_rm_sta() function shouldn't actually remove the station from
firmware when we are still associated (i.e. during a RUN -> INIT/SCAN
transition).

* So when disassociating we will first call iwm_mvm_rm_sta() to drain the
queues/fifos. Later during disassociation we will then use
iwm_mvm_rm_sta_id() to actually remove the station.

Inspired-By: Linux iwlwifi

MFC r318224:

[iwm] Refuse connection to APs with beacon interval < 16.

MFC r318223:

[iwm] Handle AUTH->SCAN/INIT and ASSOC->SCAN/INIT better

* Tear down the relevant firmware state (i.e. the station, the vif binding)
in these transition cases.

* Before this case would leave the firmware state lying around, resulting
in errors and firmware panics in the subsequent association attempts.

MFC r318222:

[iwm] Factor out firmware station handling into if_iwm_sta.c.

* This adds iwm_mvm_rm_sta(), which will be used to tear down firmware
state for better/cleaner iwm_newstate() handling.

* Makes iwm_enable_txq() and iwm_mvm_flush_tx_path() non-static, add
the declarations to if_iwm_util.h for now.

MFC r318219:

[iwm] Properly implement iwm_wme_update callback function.

* Inspired by iwn(4) and Linux iwlwifi.

* Read wme parameters into a buffer within struct iwm_vap in
iwm_wme_update().

* If we aren't associated yet, the new settings will soon be sent
by iwm_mvm_mac_ctxt_changed() during association.

* If we are already associated, explicitly call iwm_mvm_mac_ctxt_changed()
from iwm_wme_update() to send the new settings to the firmware.

* Change iwm_mvm_ac_to_tx_fifo mapping, to fit the freebsd net80211
WME stream class numbering, instead of Linux's enum ieee80211_ac_numbers.

MFC r318218:

[iwm] Process multiple frames per RX buffer.

* Factor out iwm_handle_rxb() function from iwm_notif_intr().

* Removing the IWM_FH_RCSR_CHNL0_RX_CONFIG_SINGLE_FRAME_MSK flag allows
the device to put multiple frames (both command responses and 80211
frames) into a single RX buffer.

* Uses m_copym() to split up the receive buffers when multiple 80211
frames are received in one RX buffer. The effect is basically the same
as when using m_split(), but we want to keep the original mbuf around
when calling iwm_mvm_rx_rx_mpdu() to make error handling a bit easier
for now.

* Contains a small optimization to avoid the m_copym() when only a single
80211 frame is received in one RX buffer (i.e. matching the existing
behaviour).

MFC r318216:

[iwm] Sync iwm_read_firmware()'s loop to iwlwifi's code.

MFC r318215:

[iwm] change the check for ADD_STA status, use IWM_ADD_STA_STATUS_MASK.

MFC r318214:

[iwm] Sanity check channel for IEEE80211_CHAN_ANYC in if_iwm_mac_ctxt.c.

* This avoids panicing in some broken vap state handling cases.

MFC r318013:

[iwm] Move in_phyctxt from struct iwm_node to phy_ctxt in struct iwm_vap.

* This better matches how things are organized in Linux's iwlwifi.

MFC r318005:

[iwm] Add basic powermanagement support via ifconfig wlan0 powersave.

* The DEVICE_POWER_FLAGS_CAM_MSK flag was removed in the upstream iwlwifi
in Linux commit ceef91c89480dd18bb3ac51e91280a233d0ca41f.

* Add sc_ps_disabled flag to struct iwm_softc, which corresponds to
mvm->ps_disabled in struct iwl_mvm in Linux iwlwifi.

* Adds a hw.iwm.power_scheme tunable which corresponds to the power_scheme
module parameter in Linux iwlwifi. Set this to 1 for completely
disabling power management, 2 (default) for balanced powermanagement,
and 3 for lowerpower mode (which does dtim period skipping).

* Imports the constants.h file from iwlwifi as if_iwm_constants.h.

* This doesn't allow changing the powermanagement setting while connected,
also one can only choose between enabled and disabled powersaving with
ifconfig (so switching between balanced and low-power mode requires
rebooting to change the tunable).

* After any changes to powermanagement (i.e. "ifconfig wlan0 powersave" to
enable powermanagement, or "ifconfig wlan0 -powersave" for disabling
powermanagement), one has to disconnect and reconnect to the accespoint
for the change to take effect.

MFC r318003:

[iwm] Add iwm_nic_unlock() calls missing from previous commit.

MFC r318002:

[iwm] iwm_{read,write}_prph() don't grab the nic lock in iwm themselves.

* Fix a couple of cases where the nic lock ended up not being grabbed
during an iwm_read_prph() or iwm_write_prph().

MFC r315926:

[iwm] Add the BSS's basic rates to iwm's LQ command, not all the rates.

Makes the firmware use appropriate Tx rates for ACKs.

MFC r315923:

[iwm] Tiny cleanup in iwm_rx_addbuf().

MFC r315784:

[iwm] Make ucode capabilities and api flags handling more like iwlwifi.

MFC r315780:

[iwm] Remove a couple of unneeded IWM_UCODE_TLV_FLAGS_* flags.

* All the supported firmwares have these flags set.

* This removes the following flags:
IWM_UCODE_TLV_FLAGS_PM_CMD_SUPPORT,
IWM_UCODE_TLV_FLAGS_NEWBT_COEX,
IWM_UCODE_TLV_FLAGS_BF_UPDATED,
IWM_UCODE_TLV_FLAGS_D3_CONTINUITY_API,
IWM_UCODE_TLV_FLAGS_STA_KEY_CMD,
IWM_UCODE_TLV_FLAGS_DEVICE_PS_CMD,
IWM_UCODE_TLV_FLAGS_SCHED_SCAN,
IWM_UCODE_TLV_FLAGS_RX_ENERGY_API,
IWM_UCODE_TLV_FLAGS_TIME_EVENT_API_V2

* Also remove definitions and code for dealing with the v1 time-event api.

* Remove unneeded calc_rssi() function.

MFC r315778:

[iwm] Move mbuf hacks after sanity checks in iwm_mvm_rx_rx_mpdu().

* This avoids leaving the mbuf in a weird state, when dropping a packet.

MFC r315777:

[iwm] Get rid of struct iwm_rx_data argument for iwm_mvm_rx_rx_mpdu.

MFC r314192,r314209:

[iwm] Add support for Firmware paging, needed for newer 8000C firmware.

* Uses the IWM_FW_PAGING_BLOCK_CMD firmware command to tell the firmware
what memory ranges to use for paging.

MFC r314082:

[iwm] Move iwm_dma_contig_alloc/_free functions to if_iwm_util.c.

MFC r314076:

[iwm] Move struct iwm_cfg chipset configs to if_iwm_7000.c and _8000.c

* This is more similar to how code/definitions are distributed in
Linux's iwlwifi.

* This should make recognizing new chipset variants, and adding additional
flags from the Linux iwlwifi code easier, without blowing up if_iwm.c

MFC r314074:

[iwm] Simplify device id matching code a bit.

* Just add the struct iwm_cfg pointers to the iwm_devices array, to get
rid of the large switch clause.

MFC r314070:

[iwm] Fix typo in commit a7697ea01c11fd493aec52260a02f31df680eb91.

* The sc->sc_uc.uc_error_event_table value is now at sc->error_event_table,
and not sc->umac_error_event_table.

MFC r314069:

[iwm] Get rid of unneeded IWM_FWDMASEGSZ and IWM_FWMAXSIZE constants

* We only need IWM_FH_MEM_TB_MAX_LENGTH bytes for the fw_dma memory.

MFC r314067:

[iwm] With the previous commits, this DELAY no longer seems to be needed.

MFC r314066:

[iwm] Sync IWM_MVM_ALIVE waiting and start_fw handling with iwlwifi.

* Use the notification wait API, like it's done in the Linux iwlwifi code,
to wait for the IWM_MVM_ALIVE notification.

* This also should fix some firmware load interrupt issues, and errors
in the nic lock using.

Tested:

* (adrian) Intel 7260, STA mode

MFC r314065:

[iwm] Synchronize firmware loading code with Linux iwlwifi.

* While there, rename some functions to match the names and functionality
of the similarly named functions in Linux iwlwifi.

MFC r313430:

[iwm] Remove 1s delay after fw loading. Can't reproduce issues on AC8260.

The 1s delay was added in the update to version 16 fw, where Family 8000
support was added.

MFC r313429:

[iwm] SCAN_ABORT_UMAC response doesn't use a wide id

MFC r313427:

[iwm] Recognize the IWM_UCODE_TLV_FW_MEM_SEG firmware section type.

* Will be needed for loading version 22 of 7265D firmware.

MFC r313418:

[iwm] Recognize IWM_DTS_MEASUREMENT_NOTIF_WIDE notification.

* Add the command groups enum, and the iwm_phy_ops_subcmd_ids enum
to if_iwmreg.h definitions.

* The IWM_DTS_MEASUREMENT_NOTIF_WIDE notification will be generated by
version 17 firmware.

Taken-From: Linux iwlwifi

MFC r313417:

[iwm] Very basic DTS thermal sensor support (prints temp as debug msg).

* Adds IWM_DEBUG_TEMP debug message type, for printing messages related
to temperature sensors and thermal/TDP infos.

* The firmware regularly sends us DTS measurement notifications, so just
print the temperature value as a debugging message.

(Adrian's addition):

* Eventually this can be used by the driver to limit transmit rate / power to
try and do some thermal throttling.

MFC r313416:

[iwm] Only for family 7000 power-down busmaster DMA clocks when stopping.

MFC r313415:

[iwm] Implement apmg_wake_up_wa workaround properly for 7000 family.

* Add iwm_pcie_set_cmd_in_flight() and iwm_pcie_clear_cmd_in_flight()
helper methods.

* Use ring->queued tracking in the command queue to set/clear the
cmd_hold_nic_awake bit at the right points.

MFC r313414:

[iwm] Use iwm_mvm_scan_stop_wait to properly abort scans.

* Add IWM_FLAG_SCAN_RUNNING to sc->sc_flags to track whether the firmware
is currently running a scan, in order to decide wheter iwm_scan_end
needs to abort a running scan.

* In iwm_scan_end, if the scan is still running, we now abort it, in order
to keep the firmware scanning state in sync.

* Try to make things a bit simpler, by reacting on the
IWM_SCAN_OFFLOAD_COMPLETE and IWM_SCAN_COMPLETE_UMAC notifications,
instead of IWM_SCAN_ITERATION_COMPLETE and
IWM_SCAN_ITERATION_COMPLETE_UMAC. This should be fine since we always
only tell the firmware to do a single scan iteration anyway.

MFC r313413:

[iwm] Add scan abort functions, to properly cancel a running scan.

* Uses the notification wait api to wait for the corresponding scan
complete notification after sending the abort command.

MFC r313412:

[iwm] Get rid of iwm_disable_rx_dma, just use iwm_pcie_rx_stop directly.

* This also fixes one of many small nic lock handling bugs, and matches
iwlwifi's code.

MFC r313325:

[iwm] Use notification wait API to wait for calibration to complete.

Tested:

* 7260, STA mode (2g, 5g)

MFC r313322,r313354:

[iwm] Add implementation of the notification wait api from iwlwifi.

MFC r313317:

[iwm] Change 2nd arg of iwm_phy_db_set_section() to struct iwm_rx_packet.

* This matches the function declaration in Linux's iwlwifi.

MFC r313315,r313316:

[iwm] Get rid of some gratuitous constant renaming wrt. Linux iwlwifi.

* IWM_UCODE_SECT_MAX -> IWM_UCODE_SECTION_MAX

* IWM_UCODE_TYPE_* -> IWM_UCODE_* (except for IWM_UCODE_TYPE_MAX which
stays).

[iwm] Store paging_mem_size field in firmware image information struct.

MFC r313314:

[iwm] Sync valid_tx_ant and valid_rx_ant mask handling with iwlwifi.

* This fixes the phy_cfg field sent in the iwm_send_phy_cfg_cmd()
command, which wasn't taking into account the valid_rx_ant and
valid_tx_ant masks from nvm_data before.

Tested:

* 7260, STA mode, 2G and 5G

MFC r313312:

[iwm] Use chipset configuration structs like iwlwifi does.

* This makes it a bit easier to factor out common parts for e.g. the
7000 chipset family.

* Add iwm7265d config, and recognize the 7265D chipset variant via the
hardware revision.

Tested:

* 7260, STA mode (2ghz)

MFC r313311:

[iwm] Sync nvm parsing code with Linux iwlwifi.

* sc->sc_nvm becomes sc->nvm_data and is now a pointer instead of an
inlined struct.

* Add sc->eeprom_size and sc->nvm_hw_section_num configuration values to
struct iwm_softc.

* For now continue to avoid negative error return-values, and use pointer
variables for some return values, as before.

* Continue to omit LAR (location aware regulatory) related code as well.

Tested:

* Intel 7260, STA mode (2GHz)

MFC r313310:

[iwm] make sure we call iwm_detach_local() only once.

MFC r313309:

[iwm] Sync if_iwm_phy_db code with Linux iwlwifi.

MFC r308777:

[iwm] Sync iwm_nvm_read_chunk() function with Linux iwlwifi.

This fixes an error handling detail in iwm_nvm_read_chunk(), where an
error response from the firmware for an NVM read shouldn't be fatal if
the offset was non-zero.

MFC r308577:

iwm: If firmware load fails during init via iwm_preinit() we bail out
before calling ieee80211_ifattach() so the taskqueue hasn't been
initialized. Don't try to drain it, we'll panic.
Looks like this issue was introduced in r303326.

MFC r308183:

[iwm] Get rid of SYNC_RESP_STRUCT and SYNC_RESP_PTR macros.

* SYNC_RESP_STRUCT and SYNC_RESP_PTR originate from the OpenBSD version of
iwm, and they weren't serving any real purpose in the FreeBSD port.

* We just do a single bus_dmamap_sync for syncing the complete received frame,
instead of explicitly bus_dmamap_sync-ing subranges of the frame like in
the OpenBSD iwm code.

MFC r306900:

iwm: add missing 'Rx errors' counter incrementation.

MFC r306286:

[iwm] fix default antenna selection a bit; fix 5GHz rate control handling.

* Don't do the antenna switching when setting up the rate table - we don't
take into account whether it's an active antenna or not (eg shared with BT.)
I'll look into this a bit more later.

* The default antenna is still 1, I'll look into that a bit more later.
(So no, this doesn't fix it for Larry who needs ANT_B to be active, not
ANT_A.)

* My changes to the rate control setup used the wrong method for finding
a suitable rate, which led to 1M CCK frames being queued for 11a operation.
This is .. sub-optimal. Change the rate control lookup path to use
the global table instead of the per-node table, which won't be setup
until the node rate table is setup (which happens way too late in this
game.)

Tested:

* Intel 7260, 2G and 5G operation.

MFC r306142:

[iwm] use rate control info from the node txrates; use mgmtrate for EAPOL frames

This changes the transmit rate control code to do a few things:

* use fixed rates (mcast, ucast, mgmt) where required.
* Don't use a hard-coded 11a or 11bg rate for non-data frames -
use what net80211 says we should use.
* use mgmtrate for EAPOL frames.

MFC r306007:

[iwm] Improve reliability of iwm_release on disassociation a bit.

* We need to first call ivp->iv_newstate(), to enqueue the deauth/deassoc
mgmt frame, then flush the tx queue, before actually calling
iwm_release().

* cycling a wlan connection via wpa_cli frontend to wpa_supplicant, by
issuing disconnect and reconnect commandos works quite well.
(There is still an issue when disconnecting/reconnecting too quickly)

* Reassociating or roaming via wpa_supplicant is still broken.

MFC r306005:

[iwm] Remove dead fw_totlen from struct iwm_fw_sects; clean up struct iwm_nvm_data.

* No functional change, none of these values were ever read.

* The values removed from struct iwm_nvm_data are only used for old dvm
devices in Linux iwlwifi, and irrelevant to iwm hence.

MFC r306005:

[iwm] Use IWM_DEFAULT_SCAN_CHANNELS define as default for sc_capa_n_scan_channels.

MFC r306004:

[iwm] Remove deprecated scan API definitions.

* This removes deprecated scan API definitions, which have been unused
since the upgrade to version 16 firmware in change r303327.

* Part of this change matches the header-file changes in Linux git commit
1f9403863c080478ad78247c89b018e95bdfb027.

* No functional change.

MFC r30600

[iwm] Remove wrappers around iwm_dma_contig_free() calls.

No functional changes.

MFC r306002

[iwm] Fix iwm_poll_bit() error value check in iwm_attach().

The iwm(4) iwm_poll_bit() function returns 1 on success, and 0 on failure,
whereas the iwl_poll_bit() in Linux iwlwifi returns < 0 on failure.

So the (ret < 0) check ended up ignoring any error returned by
iwm_poll_bit().

MFC r306001

[iwm] Fix off-by-one check in iwm_read_firmware().

This fixes a potential buffer overrun in the firmware parsing code.

MFC r305917:

[iwm] fix up RSSI calculations for both scan results and normal RX
operations.

* hard code a noise floor of -96 for now. The noise floor update
* code returns
some "interesting" values that I can't map to anything useful
right now.
* Ensure a default noise floor is set - otherwise the initial
* scan results
have a noise floor of '0'.
* Fix up the RSSI calculation to be correctly relative
* to the noise floor.
The RSSI routines return an absolute value in dBm -
so fix this up.
* Cap RSSI values appropriately.
* Ensure we pass in a 1/2 dB unit value in to
* net80211.

MFC r304880:

iwm: add 'command accepted' debug notification (copied from wpi(4)).

Now it should be easier to find out which command causes firmware
panics when few commands are sent in a short period of time.

MFC r314073:

[iwm] Remove OpenBSD-specific comment. Beautify pci cfg space
accesses.

MFC r303322,303326,303327,303345,303413,303416,303418,303557

Update iwm(4) and iwmfw(4) to current in order to stabilize and improve
functionality.

Approved by: re (gjb)