ieee80211_work_rx_mgmt currently enqueues various management frames,
including deauth and disassoc frames, however the function
ieee80211_work_rx_queued_mgmt does not handle these, as they should
only occur if the AP is buggy. It does emit a WARN_ON when this happens
though, and several users have reported such instances.
Fix the WARN_ON by not queueing such frames in the first place.
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Johannes noticed that I had incorrectly documented the context of
update_tkip_key() driver operation. It must be atomic because all
RX code is run inside rcu critical section.
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NKalle Valo <kalle.valo@iki.fi>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The TKIP key update callback is called from the RX path, where the driver
mutex is already locked. This results in a circular locking bug.
Avoid this by removing the lock.

Johannes noted that there is a separate bug: The callback still breaks on SDIO
hardware, because SDIO hardware access needs to sleep, but we are not allowed
to sleep in the callback due to mac80211's RCU locking.
Signed-off-by: NMichael Buesch <mb@bu3sch.de>
Tested-by: NLarry Finger <Larry.Finger@lwfinger.net>
Reported-by: kecsa@kutfo.hit.bme.hu
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: stable <stable@kernel.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

ath9k currently forces hw->max_rate_tries to 4 to work around rate
control inefficiencies. This has some negative side effects, such as
rate_control_send_low also using a maximum of 4 tries, which could
negatively affect reliability of unicast management frames.
This patch pushes the retry limit to the rate control instead, and
allows it to use more tries on the last stage to prevent unnecessary
packet loss.
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The following commit

	commit e4da8c37
	Author: Johannes Berg <johannes@sipsolutions.net>
	Date:   Wed Dec 23 13:15:43 2009 +0100

	   mac80211: make off-channel work generic

triggered a bug in iwlwifi where HT parameters would not be correctly set in
some mac80211 pathways. The aggregation (and possibly other) station flags were
not being set, which limited the size of aggregation blocks and reduced
throughput at high rates.

>From Johannes:
"""
Due to Wey-Yi's patch to use the set-channel command when the channel changes
while associated, we don't get a full new RXON. Therefore, we don't re-set the
rxon-station either. However, under some circumstances that apparently have
gotten more likely mac80211 will first set up the BSS info, then add the
station and then switch to an HT channel type.

Therefore, the check for "priv->current_ht_config.is_ht" in
iwl_rxon_add_station() will hit false and not fill in the HT information.

However, that check can just be removed, which is the easiest fix for all this,
because the HT capa struct is always there, just could possibly have the
ht_supported member set to false.
"""

A sample good link in my 3x3 network improves by approximately 25% TCP
throughput. This fixes Bug 2144
(http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2144).
Signed-off-by: NDaniel Halperin <dhalperi@cs.washington.edu>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In iwlagn the support for spectrum measurement command has been
disabled since v2.6.29 without any requests for it. In addition to this
when this command is indeed enabled it has been found to trigger firmware
SYSASSERT on at least 4965 and 5100 hardware (see
http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=1952 ). Since then
this code has been bitrotting and cannot just be enabled without porting.

Remove support for spectrum measurement command from iwlagn. It can be
added back if there is a future need and the firmware problem it triggers
has been fixed. Support for the spectrim measurement notification remains
as it has been enabled all the time.

In addition to this remove the 3945 spectrum measurement command Kconfig
option and make this command always supported. The code added by this
enabling is minimal and only run when user triggers a spectrum measurement
request via sysfs.
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

sparse won't check endianness annotations by
default, but iwlwifi is and should be clean
so we can make sparse check them on it.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

sparse correctly warns about symbol not
being static, make static to shut it up.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The debugfs code can be made a whole lot more
efficient by using debugfs_remove_recursive(),
the large chunk of variables can completely go
away and by moving two variables we no longer
need to allocate an extra chunk of memory.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

It is better to first notify cfg80211 about the hw
rfkill state (so the rfkill device that will be
registered won't have the wrong state while being
registered), and the power/tt variable init can
(and probably should) also be done first.

Also rename iwl_setup_mac to
iwl_mac_setup_register to better describe what it
really does.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

It really hasn't been for a long time, not sure
why this stuck around.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Adding "bt_coex_active" module parameter for iwlcore to enable/disable
BT coexist; if bt_coex_active is true (default), uCode will do kill/defer
every time the priority line is asserted (BT is sending signals on the
priority line in the PCIx). By disable the bt_coex_active, uCode will
ignore the BT activity and perform the normal operation.

Users might experience transmit issue on some platform due to this
WiFi/BT co-exist problem. The possible symptoms are: NetworkManager and
other similar programs can scan and find all the available APs, but will
timeout and unable to associate with any of the APs; no out-going frames
can be found with wireless sniffer tools.

On those platforms, WiFi communication can be restored by set "bt_coex_active"
module parameter to "false"
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Give better bit filed define and description for flag parameter
in REPLY_BT_CONFIG command:

flags:
 bit 0 - 1: BT channel announcement enabled
         0: disable
 bit 1 - 1: priority of BT device enabled
         0: disable
 bit 2 - 1: BT 2 wire support enabled
         0: disable
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add function pointer for broadcast station addition so that we can call it
in from iwlcore at a later time. We only distinguish between iwlagn and
iwl3945 broadcast station addition. For the iwl3945 station addition we add
that function to iwlcore since that is where most station functionality
resides, making it part of iwl3945 will require significant code
reorganization that will dilute station management functionality. This
seems to be an efficient solution.

It may seem as though we are removing error checking when adding the 3945
broadcast station but this error checking was never really necessary since
the function returns the station id and the broadcast station id is always
set.
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The work done when a station is added is very similar whether the station
is added synchronously or asynchronously. Centralize this work. At the same
time increase the status flags being checked for when the command returns
with accompanying debug messages. Also increase checking when setting the
"ucode active" state with accompanying debugging.

This work is done in preparation for station notification support.
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

From: Abhijeet Kolekar <abhijeet.kolekar@intel.com>

For 6X50 DC calibration needs to be initialized
else uCode will run an endless loop.
Enbale DC calibration in hw config.
Signed-off-by: NAbhijeet Kolekar <abhijeet.kolekar@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

We have seen the throughput dropped due to external noisy environment
and the radio is out of tune.  There are lot of plcp errors indicating
this condition. Eventually the station can get de-authenticated by the
Access Point.  By resetting and tuning the radio, the plcp errors are
reduced or eliminated and the throughput starts to rise.

To prevent unexpected behavior such as drop in throughput or deauthentication,
- The change provides the driver feature to monitor and tune the radio base on
the statistics notification from the uCode.
- It also allows the setting of the plcp error rate threshold via
the plcp_delta under debugfs interface.
Signed-off-by: NTrieu 'Andrew' Nguyen <trieux.t.nguyen@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add additional logic for internal scan routine to control how
frequent this function should be performed.

The intent of this function is to reset/re-tune the radio and bring the
RF/PHY back to normal state, it does not make sense calling it too
frequent,
if reset the radio can not bring it back to normal state, it indicate
there are other reason to cause the radio not operate correctly.
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch allows A band to be scanned when driver is associated to AP.
Scan mechanism is that mac80211/cfg80211 requests driver to scan G band
first and then immediately to scan A band. Original code require
driver to wait for 2 seconds after any scan before another scan will be
performed. This caused driver to service G band scan request from
mac80211/cfg80211 but deny the A band scan request.
Signed-off-by: NHenry Zhangh <hongx.c.zhang@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Adding "radio reset" function to help reset and stabilize the radio.

During normal operation, sometime for unknown reason, radio encounter
problem and can not recover by itself; the best way to
recover from it is to reset and re-tune the radio. Currently, there is
no RF reset command available, but since radio will get reset when
switching channel, use internal hw scan request to force radio
reset and get back to normal operation state.

The internal hw scan will only perform passive scan on the first
available channel (not the channel being used) in associated state. The
request should be ignored if already performing scan operation or STA is
not in associated state.

Also include an "internal_scan" debugfs file to help trigger the
internal scan from user mode.
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add support to configure missed beacon threshold, by default, if receive
"missed beacon" notification from uCode and has more than 5 consecutive
beacon missed, then perform sensitivity calibration; with this change,
allow user to adjust the missed beacon threshold from debugfs in case
more sensitivity calibration required for better performance in noisy
environment

The default value (=5) should be good enough for the normal condition,
but for very noisy environment, more sensitivity calibration could help
improve the throughput, so by setting the missed beacon threshold to
lower number, user might experience better performance result.
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Pavel Roskin reported a crash in ieee80211_tx_h_select_key():

http://marc.info/?l=linux-wireless&m=126419655108528&w=2

This is a regression from patch "mac80211: move control.hw_key assignment".
Fix it as suggested by Johannes, adding an else statement to make sure
that tx->key is not accessed when it's null.

Compile-tested only.
Reported-by: NPavel Roskin <proski@gnu.org>
Cc: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: NKalle Valo <kalle.valo@iki.fi>
Tested-by: NBob Copeland <me@bobcopeland.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

ieee80211_tx_h_select_key might decide that a frame
need not be encrypted at all, in which case it will
clear tx->key. In that case it may crash if a key
was previously selected, e.g. as the default key.

This is also due to my patch
"mac80211: move control.hw_key assignment".
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch continues the effort which began with:
"[PATCH] p54pci: move tx cleanup into tasklet".

Thanks to these changes, p54pci's interrupt & tx
cleanup routines can be made lock-less.
Signed-off-by: NChristian Lamparter <chunkeey@googlemail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The loop that passes non-data frames to all relevant vifs inside the
__ieee80211_rx_handle_packet keeps a pointer to the previous sdata to
avoid having to make unnecessary copies of the frame it's handling.
This led to a bug that caused it to apply the ieee80211_rx_data state
to the wrong interface, thereby either missing the rx.sta pointer or
having it assigned where it shouldn't be.
This breaks (among other things) aggregation on some vifs, as action
frame exchages are dropped to the cooked monitor interface due to
rx->sta being NULL.
Fix this by restructuring the loop so that it prepares the rx data just
before making the skb copy and calling the rx handlers.

Cc: stable@kernel.org
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

As all bt packets are priority traffic during bt scan, wifi
will get disconnected when bt scan lasts for few seconds. Fix
this by allocating 10% of bt period time (4.5ms) to wifi fully.
Signed-off-by: NVasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The beacon sent gating doesn't seem to work with any combination
of flags.  Thus, buffered frames tend to stay buffered forever,
using up tx descriptors.

Instead, use the DBA gating and hold transmission of the buffered
frames until 80% of the beacon interval has elapsed using the ready
time.  This fixes the following error in AP mode:

   ath5k phy0: no further txbuf available, dropping packet

Add a comment to acknowledge that this isn't the best solution.
Signed-off-by: NBob Copeland <me@bobcopeland.com>
Acked-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When using the external sleep clock in AP mode, the
TSF increments too quickly, causing beacon interval
to be much lower than it is supposed to be, resulting
in lots of beacon-not-ready interrupts.

This fixes http://bugzilla.kernel.org/show_bug.cgi?id=14802.
Signed-off-by: NBob Copeland <me@bobcopeland.com>
Acked-by: NNick Kossifidis <mickflemm@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

ieee80211_hdrlen() should account account new HT Control field in 802.11
data frame header introduced by IEEE 802.11n standard.

According to 802.11n-2009 HT Control field is present in data frames
when both of following are met:

   1. It is QoS data frame.
   2. Order bit is set in Frame Control field.

The change might be totally compatible with legacy non-11n aware frames,
because 802.11-2007 standard states that "all QoS STAs set this subfield
to 0".
Signed-off-by: NAndriy V. Tkachuk <andrit@ukr.net>
Acked-by : Benoit Papillault <benoit.papillault@free.fr>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

If a device has multiple MAC addresses, userspace will
need to know about that. Similarly, if it allows the
MAC addresses to vary by a bitmask.

If a driver exports multiple addresses, it is assumed
that it will be able to deal with that many different
addresses, which need not necessarily match the ones
programmed into the device; if a mask is set then the
device should deal addresses within that mask based
on an arbitrary "base address".

To test it all and show how it is used, add support
to hwsim even though it can't actually deal with
addresses different from the default.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When a TKIP key is updated, we should pass the station
pointer instead of just the address, since drivers can
use that to store their own data. We also need to pass
the virtual interface pointer.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

"mac80211: move control.hw_key assignment" changed an if-else into two
separate if statments, but the if-else is needed to prevent
dereferencing a null info->control.hw_key.  This fixes avoids a lock-up
during association on my machine when using WEP.
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Users wishing to tweak tx power want it to happen immediately,
try to respect that. This was tested by Lorenzo by measuring the
received signal strength from an AP with ath9k and the patch.

Changing the tx power on the AP produced these results:

1) iwconfig wlan0 txpower 20 ---> Rx power -37dbm
2) iwconfig wlan0 txpower 15 ---> Rx power -41dbm
3) iwconfig wlan0 txpower 10 ---> Rx power -45dbm
4) iwconfig wlan0 txpower 5 ---> Rx power -51dbm
5) iwconfig wlan0 txpower 0 ---> Rx power -37dbm

The result with 0 is an anomoly and would need to be
addressed through a separate patch.
Signed-off-by: NLuis R. Rodriguez <lrodriguez@atheros.com>
Tested-by: NLorenzo Bianconi <lorenzo.bianconi83@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

nl80211_associate() was rejecting (re)association attempts with EBUSY
in some cases where we are currently associated with an AP that uses
different channel from the destination AP. Fix this by passing the
current wdev to rdev_fixed_channel() in the same way that was already
done for join-IBSS and connect commands. This allows the fixedchan
check to skipped for the current wdev and allows the reassociation to
proceed.
Signed-off-by: NJouni Malinen <j@w1.fi>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>