When we disassociate, mac80211 removes the station and
then, it sets the bss it unsets the assoc bool in bss_info.

Since the firwmware wants it the opposite (first set the
MAC context as unassoc, and only then, remove the STA of
the API), we have a small period of time in which the STA
in firmware doesn't have a valid ieee80211_sta pointer.
During that time, iwl_mvm_vif->ap_sta_id, is still set
to the STA in firmware that represent the AP.

This avoids:

[ 4481.476246] BUG: unable to handle kernel NULL pointer dereference at 00000045
[ 4481.479521] IP: [<f8416a6a>] iwl_mvm_bt_coex_reduced_txp+0x7a/0x190 [iwlmvm]
[ 4481.482023] *pde = 00000000
[ 4481.484332] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
[ 4481.486897] Modules linked in: netconsole configfs autofs4 rfcomm(O) bnep(O) nfsd nfs_acl auth_rpcgss exportfs nfs lockd binfmt_misc sunrpc fscache arc4 iwlmvm(O) mac80211(O) btusb(O) iwlwifi(O) bluetooth(O) cfg80211(O) snd_hda_codec_hdmi coretemp dell_wmi snd_hda_codec_idt compat(O) dell_laptop aesni_intel i915 sparse_keymap dcdbas cryptd psmouse serio_raw aes_i586 microcode snd_hda_intel drm_kms_helper snd_hda_codec drm snd_pcm snd_timer i2c_algo_bit video intel_agp intel_gtt snd soundcore snd_page_alloc crc32c_intel ahci sdhci_pci libahci sdhci mmc_core e1000e xhci_hcd [last unloaded: configfs]
[ 4481.502983]
[ 4481.505599] Pid: 6507, comm: kworker/0:1 Tainted: G           O 3.4.43-dev #1 Dell Inc. Latitude E6430/0CMDYV
[ 4481.508575] EIP: 0060:[<f8416a6a>] EFLAGS: 00010246 CPU: 0
[ 4481.511248] EIP is at iwl_mvm_bt_coex_reduced_txp+0x7a/0x190 [iwlmvm]
[ 4481.513947] EAX: ffffffea EBX: 00000002 ECX: 00000001 EDX: 00000001
[ 4481.516710] ESI: ec6f0f28 EDI: 00000000 EBP: e8175dfc ESP: e8175d9c
[ 4481.519445]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 4481.522185] CR0: 8005003b CR2: 00000045 CR3: 01a5e000 CR4: 001407d0
[ 4481.524950] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 4481.527768] DR6: ffff0ff0 DR7: 00000400
[ 4481.530565] Process kworker/0:1 (pid: 6507, ti=e8174000 task=e8032b20 task.ti=e8174000)
[ 4481.533447] Stack:
[ 4481.536379]  e472439f 00003a12 e8032b20 e8033048 00000001 e8175ddc 00000246 e8033040
[ 4481.540132]  00000002 01814990 ec4d1ddc e8175dcc 00000000 00000000 00000000 00000000
[ 4481.543867]  00000000 00000000 00000001 000001c8 009b0002 ec4d1ddc ec6f0f28 00000000
[ 4481.547633] Call Trace:
[ 4481.550578]  [<f8418027>] iwl_mvm_bt_rssi_event+0x197/0x220 [iwlmvm]
[ 4481.553537]  [<f840919c>] iwl_mvm_stat_iterator+0xdc/0x240 [iwlmvm]
[ 4481.556582]  [<f8d129c2>] __iterate_active_interfaces+0xe2/0x1f0 [mac80211]
[ 4481.559544]  [<f84090c0>] ? iwl_mvm_update_smps+0x90/0x90 [iwlmvm]
[ 4481.562519]  [<f84090c0>] ? iwl_mvm_update_smps+0x90/0x90 [iwlmvm]
[ 4481.565498]  [<f8d12b0c>] ieee80211_iterate_active_interfaces+0x3c/0x50 [mac80211]
[ 4481.568421]  [<f8409b43>] iwl_mvm_rx_statistics+0xb3/0x130 [iwlmvm]
[ 4481.571349]  [<f8405431>] iwl_mvm_async_handlers_wk+0xc1/0xf0 [iwlmvm]
[ 4481.574251]  [<c1052915>] ? process_one_work+0x105/0x5c0
[ 4481.577162]  [<c1052991>] process_one_work+0x181/0x5c0
[ 4481.580025]  [<c1052915>] ? process_one_work+0x105/0x5c0
[ 4481.582861]  [<f8405370>] ? iwl_mvm_rx_fw_logs+0x20/0x20 [iwlmvm]
[ 4481.585722]  [<c10530f1>] worker_thread+0x121/0x2c0
[ 4481.588536]  [<c1052fd0>] ? rescuer_thread+0x1d0/0x1d0
[ 4481.591323]  [<c105af0d>] kthread+0x7d/0x90
[ 4481.594059]  [<c105ae90>] ? flush_kthread_worker+0x120/0x120
[ 4481.596868]  [<c15b7cc2>] kernel_thread_helper+0x6/0x10
[ 4481.599605] Code: 9d de c3 c8 85 c0 74 0d 80 3d f8 ae 42 f8 00 0f 84 dc 00 00 00 8b 45 c8 0f b6 d3 31 ff 89 55 c0 8b 84 90 d8 03 00 00 0f b6 55 c7 <38> 50 5b 89 45 bc 0f 84 a8 00 00 00 a1 e4 d2 04 c2 85 c0 0f 84
[ 4481.611782] EIP: [<f8416a6a>] iwl_mvm_bt_coex_reduced_txp+0x7a/0x190 [iwlmvm] SS:ESP 0068:e8175d9c
[ 4481.614985] CR2: 0000000000000045
[ 4481.687441] ---[ end trace b11bc915fbac4412 ]---
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The number of commands can never be negative, so it should
be using an unsigned type. This also shuts up an smatch
warning elsewhere in the code.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Change old UAPSD bit to PM_CMD_SUPPORT, and add a new bit to indicate
real UAPSD support.
Don't use UAPSD when the firmware doesn't support it.
Signed-off-by: NDavid Spinadel <david.spinadel@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Integers need to be multiplied before division.
Signed-off-by: NDavid Spinadel <david.spinadel@intel.com>
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The fw_rx_stats entry in debugfs was getting truncated because the
internal buffer used to hold the string was too short.  The
calculation of the needed buffer size was rather bogus.

Simplify the calculation by multiplying the number of entries in the
entire structure by the size of each data line and adding the size of
the header lines.

Additionally, add the mac_id value, which was missing.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The activity grading indication from the firmware should
not be used in this case, but the bt_status in the firwmare
notification.
Fix that.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The firmware always expects the Coex Mode to be set.
Moreover, the firmware expects bit 0 is the valid bits to
be set all the times.
I misunderstood the API and didn't set these bits when
commands are sent to update the paramters of the Coex. As
a result, the firmware understood that the BT Coex was
disabled (Coex mode = 0) and ignored all the updates (valid
bit 0 clear).

Fix that.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Section size limitation to 6000 is incorrect.
NVM file need to support bigger sections in order
to support PAPD tables.
Signed-off-by: NIdan Kahlon <idanx.kahlon@intel.com>
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Reviewed-by: NMaor Perez <maorx.perez@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Support Signed firmware based on code signing system (CSS)
protocol and dual CPUs download,
the code recognize if there are more than one CPU and
if we need to operate the signed protocol according to
the ucode binary image
Signed-off-by: NEran Harary <eran.harary@intel.com>
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

At the firmware level, IBSS support has similar programming
requirements as AP/GO support, so use the same functions with
just small differences.

With IBSS only a single virtual interface can be used, so no
changes in the advertised interface combinations are needed.

For now, don't use hardware crypto for the GTKs in IBSS mode,
the firmware should support it though.
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

7265 is a very similar device to 7260, so just add
the definitions based on 7260 for it.
Signed-off-by: NEran Harary <eran.harary@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Remove code that is not needed and always allow MIMO when
in tight mode. In loose mode, we should avoid MIMO since BT
can use the other antenna to Rx while we Tx.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The code limiting the AMPDU length due to BT traffic was
duplicated. Remove the redundant code.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Tests have shown that we should start AMPDU even when BT
is active. So remove that constraint.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Tests have shown that we should go SMSP_STATIC when BT
traffic is high, and stay in dynamic if BT traffic is low.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

BT Coex needs to be updated when the bandwidth is modified
by the AP.
While at it, remove the vif parameter from
bt_coex_vif_change since it was unused.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Until now, after WoWLAN, we weren't able to keep the
connection to the AP because the firmware didn't give
us the right information. Since the firmware API has
been changed to include all the information we need,
change the driver to work with the new API (if it is
available) and program all the relevant information
in mac80211 to keep the connection.
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Some NICs embedded in platforms that have only 16 Tx queues,
this affect the mapping of the Tx queues.
Signed-off-by: NEytan Lifshitz <eytan.lifshitz@intel.com>
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Reviewed-by: NGregory Greenman <gregory.greenman@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Some NICs aren't allowed to be powered up at driver load time.
Fix it, and move the external NVM loading from driver load time to
driver up time (parsing the external nvm file remains at driver load time).
Signed-off-by: NEytan Lifshitz <eytan.lifshitz@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

FW starts using legacy power table command (0x77) for device wide power
settings. Currently this command contains only option flags field.
It can configure the following: CAM (Continuous Active Mode) and
POWER_SAVE_ENABLE debug option. Send this command when firmware is
loaded - D0 and D3.
Note: Setting this command is important to avoid unwanted FW behavior.
It particularly fixes a bug when a device does not drop to low power
after disassociation from AP.
Signed-off-by: NAlexander Bondar <alexander.bondar@intel.com>
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

This should really not happen. If it does, restarting is the
only way to recover since the driver and the firmware might
very well be out of sync. Moreover, iwl_op_mode_nic_error
will print data that might help debugging.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Single shared antenna devices need a special LUT.
Address this need.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

In loose BT Coex scheme, the aggregation size doesn't need to
be limited.

To avoid triggering it, remove a lockdep assertion - we need
to compute the AMPDU size limit from rate control code which
can't take mvm->mutex. This means that there is a race but in
the worst case, we will have a wrong AMPDU size limit which
is not a big issue.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The Ralink DPO_RT5572_LinuxSTA_2.6.1.3_20121022
reference driver uses different RSSI threshold
and VGC adjustment values for the RT3572 and
RT3593 chipsets.

Update the rt2800_link_tuner function to use the
same values. Also change the comment in the function
to make it more generic.

References:

  RT35xx_ChipAGCAdjust function in chips/rt35xx.c
  RSSI_FOR_MID_LOW_SENSIBILITY constant in include/chip/rtmp_phy.h
  RT3593_R66_MID_LOW_SENS_GET macro in include/chip/rt3593.h
  RT3593_R66_NON_MID_LOW_SEMS_GET macro in include/chips/rt3593.h
Signed-off-by: NGabor Juhos <juhosg@openwrt.org>
Acked-by: NStanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In commit 3d81535e
(rt2800: 5592: add chip specific vgc calculations)
the rt2800_link_tuner function has been modified to
adjust VGC level for the RT5592 chipset.

On the RT5592 chipset, the VGC level must be adjusted
only if rssi is greater than -65. However the current
code adjusts the VGC value by 0x10 regardless of the
actual chipset if the rssi value is between -80 and
-65.

Fix the broken behaviour by reordering the if-else
statements.

Cc: stable@vger.kernel.org
Signed-off-by: NGabor Juhos <juhosg@openwrt.org>
Acked-by: NStanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Remove the local MOVING_AVERAGE implementation, and use
the generic EWMA functions instead.
Signed-off-by: NGabor Juhos <juhosg@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In rt2800_config_channel_rf3xxx(), there's no need to toggle
RF R30 bit 7 twice.
Signed-off-by: NKevin Lo <kevlo@kevlo.org>
Acked-by: NStanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch proposes to remove the use of the IRQF_DISABLED flag

It's a NOOP since 2.6.35 and it will be removed one day.
Signed-off-by: NMichael Opdenacker <michael.opdenacker@free-electrons.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Pausing queue on flush make no sense since txdone procedure un-pause
queue. Before flush procedure we have to assure queue is stopped,
i.e. on receive path h/w RX is disabled, on transmit path queue is
disabled in mac80211. That conditions are true except one function:
rt2x00usb_watchdog_tx_dma(), so add stop/start queue there.

Note stop/start queue can be racy if we do this from multiple paths,
but currently we stop TX queues only on rt2x00lib_disable_radio(),
which also stop/sync watchdog, hance we have no race condition.
Signed-off-by: NStanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The rt2x00 driver uses 0x22 as a default VGC value
in VGC adjustment for the RT3572 chipset. In the
Ralink DPO_RT5572_LinuxSTA_2.6.1.3_20121022 driver,
this value is only used for initialization. During
VGC adjustment, the reference driver uses different
values.

Update the 'rt2800_get_default_vgc' function to
synchronize the values with the reference driver.
Also add the missing AGC initialization code into
the 'rt2800_config_channel' function.

References:
  RT35xx_SetAGCInitValue in chip/rt35xx.c
  RT35xx_ChipAGCAdjust in chip/rt35xx.c
Signed-off-by: NGabor Juhos <juhosg@openwrt.org>
Acked-by: NStanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

According to the DPO_RT5572_LinuxSTA_2.6.1.3_20121022
reference driver, programming of the 'BBP 66' register
on the RT3572 and RT3593 chipsets must be done via the
'rt2800_bbp_write_with_rx_chain' function. This ensures
that value is correclty set for all RX chains.

References:
  RT35xx_ChipAGCAdjust and RT35xx_SetAGCInitValue functions
  in chips/rt35xx.c
Signed-off-by: NGabor Juhos <juhosg@openwrt.org>
Acked-by: NStanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Update the rt2800_get_default_vgc function to use the same VGC
values that the DPO_RT5572_LinuxSTA_2.6.1.3_20121022 reference
driver uses.

References:
  RT35xx_ChipAGCAdjust in chips/rt35xx.c
  RT3593_R66_MID_LOW_SENS_GET macro in include/chip/rt3593.h
  RT3593_R66_NON_MID_LOW_SEMS_GET macro in include/chips/rt3593.h
Signed-off-by: NGabor Juhos <juhosg@openwrt.org>
Acked-by: NStanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The TXPOWER_DELTA field of the regular EEPROM
stores the TX power compensation value for HT40.
The extended EEPROM has no such field, it stores
separate TX power values for HT20 and for HT40.
Signed-off-by: NGabor Juhos <juhosg@openwrt.org>
Acked-by: NPaul Menzel <paulepanter@users.sourceforge.net>
Acked-by: NStanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The comments are indicating that the TXMIXER_GAIN_BG
and TXMIXED_GAIN_A entries are overlapping with the
RSSI_BG2 and RSSI_A2 entries in the extended EEPROM
map. This is not correct, because the upper byte of
the RSSI_BG2 and RSSI_A2 entries are reserved. There
are no TX mixer gain values are stored at all in the
extended EEPROM.

Remove the initialization of these entries from the
extended EEPROM map to reflect this.
Signed-off-by: NGabor Juhos <juhosg@openwrt.org>
Acked-by: NPaul Menzel <paulepanter@users.sourceforge.net>
Acked-by: NStanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

There are some BCM4313 out there with a PCI id of 0x4313. These devices
are missing a sprom and are only used on routers or other embedded
devices. We found one connected to a BCM63XX SoC.

This devices was found by someone in this ticket:
https://dev.openwrt.org/ticket/13551Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This PCI id is used by some BCM4313 cards without a sprom. I have seen
such a card on a router connected to some BCM63XX SoC via PCIe. There
are cards out there with the same PCI id and a BCM4311, which is a pre
ieee80211n chip only supporting ieee80211a, these are still not
supported by b43 and not detected by ssb.

This devices was found by someone in this ticket:
https://dev.openwrt.org/ticket/13551Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

bcma currently only supports PCIe cards and no PCI cards, reject them
if we find them. I have never heard of any PCI card using the AI bus
(bcma), all of them are using ssb instead.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

TI firmwares are located under ti-connectivity
directory. Update path to make sure driver can
find and load firmware blob.
Signed-off-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Currently driver name is wrong. PCI device address is visible at
/proc/interrupts instead of the name:

 43:    124      0      0      0   PCI-MSI-edge    rtsx_pci
 44:    384      0      0      0   PCI-MSI-edge    snd_hda_intel
 45:  25096      0      0      0   PCI-MSI-edge    0000:01:00.0
                                                   ^^^^^^^^^^^^

So, pass the right name. rt2x00_ops->name contains KBUILD_MODNAME
and good for that, so pass it.

Handler names will be "rt2500pci", "rt2500pci" etc.
Signed-off-by: NKirill Tkhai <tkhai@yandex.ru>
CC: Ivo van Doorn <IvDoorn@gmail.com>
CC: Gertjan van Wingerde <gwingerde@gmail.com>
CC: Helmut Schaa <helmut.schaa@googlemail.com>
CC: linux-wireless@vger.kernel.org
Acked-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>