Putting the context id of the primary phy context in
the placeholder of the secondary is obviously a bad
idea.
Spotted by smatch.

Fixes: dac94da8 ("iwlwifi: mvm: new BT Coex API")
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Reported by "make includecheck"

Tested that the corresponding sources still compile well on x86
Signed-off-by: NMichael Opdenacker <michael.opdenacker@free-electrons.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

If the firmware image that we attempt to load doesn't
actually exist we have a broken firmware file or other
code not checking things correctly, so warn in such a
case. Also avoid assigning cur_ucode/ucode_loaded then.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When writing the disable_power_off value, the LPRX
enable value also gets written unintentionally, so
fix that by adding the missing break statement.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This can be useful when using the device as a sniffer.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Having a WARN_ON() followed by a printed message is
less useful than having the message in the warning
so move the message.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

When we disassociate, mac80211 removes the station and
then, it sets the bss it unsets the assoc bool in bss_info.

Since the firwmware wants it the opposite (first set the
MAC context as unassoc, and only then, remove the STA of
the API), we have a small period of time in which the STA
in firmware doesn't have a valid ieee80211_sta pointer.
During that time, iwl_mvm_vif->ap_sta_id, is still set
to the STA in firmware that represent the AP.

This avoids:

[ 4481.476246] BUG: unable to handle kernel NULL pointer dereference at 00000045
[ 4481.479521] IP: [<f8416a6a>] iwl_mvm_bt_coex_reduced_txp+0x7a/0x190 [iwlmvm]
[ 4481.482023] *pde = 00000000
[ 4481.484332] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
[ 4481.486897] Modules linked in: netconsole configfs autofs4 rfcomm(O) bnep(O) nfsd nfs_acl auth_rpcgss exportfs nfs lockd binfmt_misc sunrpc fscache arc4 iwlmvm(O) mac80211(O) btusb(O) iwlwifi(O) bluetooth(O) cfg80211(O) snd_hda_codec_hdmi coretemp dell_wmi snd_hda_codec_idt compat(O) dell_laptop aesni_intel i915 sparse_keymap dcdbas cryptd psmouse serio_raw aes_i586 microcode snd_hda_intel drm_kms_helper snd_hda_codec drm snd_pcm snd_timer i2c_algo_bit video intel_agp intel_gtt snd soundcore snd_page_alloc crc32c_intel ahci sdhci_pci libahci sdhci mmc_core e1000e xhci_hcd [last unloaded: configfs]
[ 4481.502983]
[ 4481.505599] Pid: 6507, comm: kworker/0:1 Tainted: G           O 3.4.43-dev #1 Dell Inc. Latitude E6430/0CMDYV
[ 4481.508575] EIP: 0060:[<f8416a6a>] EFLAGS: 00010246 CPU: 0
[ 4481.511248] EIP is at iwl_mvm_bt_coex_reduced_txp+0x7a/0x190 [iwlmvm]
[ 4481.513947] EAX: ffffffea EBX: 00000002 ECX: 00000001 EDX: 00000001
[ 4481.516710] ESI: ec6f0f28 EDI: 00000000 EBP: e8175dfc ESP: e8175d9c
[ 4481.519445]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 4481.522185] CR0: 8005003b CR2: 00000045 CR3: 01a5e000 CR4: 001407d0
[ 4481.524950] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 4481.527768] DR6: ffff0ff0 DR7: 00000400
[ 4481.530565] Process kworker/0:1 (pid: 6507, ti=e8174000 task=e8032b20 task.ti=e8174000)
[ 4481.533447] Stack:
[ 4481.536379]  e472439f 00003a12 e8032b20 e8033048 00000001 e8175ddc 00000246 e8033040
[ 4481.540132]  00000002 01814990 ec4d1ddc e8175dcc 00000000 00000000 00000000 00000000
[ 4481.543867]  00000000 00000000 00000001 000001c8 009b0002 ec4d1ddc ec6f0f28 00000000
[ 4481.547633] Call Trace:
[ 4481.550578]  [<f8418027>] iwl_mvm_bt_rssi_event+0x197/0x220 [iwlmvm]
[ 4481.553537]  [<f840919c>] iwl_mvm_stat_iterator+0xdc/0x240 [iwlmvm]
[ 4481.556582]  [<f8d129c2>] __iterate_active_interfaces+0xe2/0x1f0 [mac80211]
[ 4481.559544]  [<f84090c0>] ? iwl_mvm_update_smps+0x90/0x90 [iwlmvm]
[ 4481.562519]  [<f84090c0>] ? iwl_mvm_update_smps+0x90/0x90 [iwlmvm]
[ 4481.565498]  [<f8d12b0c>] ieee80211_iterate_active_interfaces+0x3c/0x50 [mac80211]
[ 4481.568421]  [<f8409b43>] iwl_mvm_rx_statistics+0xb3/0x130 [iwlmvm]
[ 4481.571349]  [<f8405431>] iwl_mvm_async_handlers_wk+0xc1/0xf0 [iwlmvm]
[ 4481.574251]  [<c1052915>] ? process_one_work+0x105/0x5c0
[ 4481.577162]  [<c1052991>] process_one_work+0x181/0x5c0
[ 4481.580025]  [<c1052915>] ? process_one_work+0x105/0x5c0
[ 4481.582861]  [<f8405370>] ? iwl_mvm_rx_fw_logs+0x20/0x20 [iwlmvm]
[ 4481.585722]  [<c10530f1>] worker_thread+0x121/0x2c0
[ 4481.588536]  [<c1052fd0>] ? rescuer_thread+0x1d0/0x1d0
[ 4481.591323]  [<c105af0d>] kthread+0x7d/0x90
[ 4481.594059]  [<c105ae90>] ? flush_kthread_worker+0x120/0x120
[ 4481.596868]  [<c15b7cc2>] kernel_thread_helper+0x6/0x10
[ 4481.599605] Code: 9d de c3 c8 85 c0 74 0d 80 3d f8 ae 42 f8 00 0f 84 dc 00 00 00 8b 45 c8 0f b6 d3 31 ff 89 55 c0 8b 84 90 d8 03 00 00 0f b6 55 c7 <38> 50 5b 89 45 bc 0f 84 a8 00 00 00 a1 e4 d2 04 c2 85 c0 0f 84
[ 4481.611782] EIP: [<f8416a6a>] iwl_mvm_bt_coex_reduced_txp+0x7a/0x190 [iwlmvm] SS:ESP 0068:e8175d9c
[ 4481.614985] CR2: 0000000000000045
[ 4481.687441] ---[ end trace b11bc915fbac4412 ]---
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

The number of commands can never be negative, so it should
be using an unsigned type. This also shuts up an smatch
warning elsewhere in the code.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Change old UAPSD bit to PM_CMD_SUPPORT, and add a new bit to indicate
real UAPSD support.
Don't use UAPSD when the firmware doesn't support it.
Signed-off-by: NDavid Spinadel <david.spinadel@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Since we set IEEE80211_HW_QUEUE_CONTROL, we can let
mac80211 do the queue assignement and don't need to
override its decisions.
While reassiging the same values is harmless of course,
it triggered  a WARNING when iwlwifi and mac80211 came
to different conclusions. This happened when mac80211 set
IEEE80211_TX_CTL_SEND_AFTER_DTIM, but didn't route the
packet to the cab_queue because no stations were asleep.

iwlwifi should not override mac80211's decicions for
offchannel packets and packets to  be sent after DTIM,
but it should override mac80211's decision for AMPDUs
since we have a special queue for them. So for AMPDU,
we still override info->hw_queue by the AMPDU queue.

This avoids:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 2531 at drivers/net/wireless/iwlwifi/dvm/tx.c:456 iwlagn_tx_skb+0x6c5/0x883()
Modules linked in:
CPU: 0 PID: 2531 Comm: hostapd Not tainted 3.12.0-rc5+ #1
Hardware name:                  /D53427RKE, BIOS RKPPT10H.86A.0017.2013.0425.1251 04/25/2013
 0000000000000000 0000000000000009 ffffffff8189aa62 0000000000000000
 ffffffff8105a4f2 ffff880058339a48 ffffffff815f8a04 0000000000000000
 ffff8800560097b0 0000000000000208 0000000000000000 ffff8800561a9e5e
Call Trace:
 [<ffffffff8189aa62>] ? dump_stack+0x41/0x51
 [<ffffffff8105a4f2>] ? warn_slowpath_common+0x78/0x90
 [<ffffffff815f8a04>] ? iwlagn_tx_skb+0x6c5/0x883
 [<ffffffff815f8a04>] ? iwlagn_tx_skb+0x6c5/0x883
 [<ffffffff818a0040>] ? put_cred+0x15/0x15
 [<ffffffff815f6db4>] ? iwlagn_mac_tx+0x19/0x2f
 [<ffffffff8186cc45>] ? __ieee80211_tx+0x226/0x29b
 [<ffffffff8186e6bd>] ? ieee80211_tx+0xa6/0xb5
 [<ffffffff8186e98b>] ? ieee80211_monitor_start_xmit+0x1e9/0x204
 [<ffffffff8171ce5f>] ? dev_hard_start_xmit+0x271/0x3ec
 [<ffffffff817351ac>] ? sch_direct_xmit+0x66/0x164
 [<ffffffff8171d1bf>] ? dev_queue_xmit+0x1e5/0x3c8
 [<ffffffff817fac5a>] ? packet_sendmsg+0xac5/0xb3d
 [<ffffffff81709a09>] ? sock_sendmsg+0x37/0x52
 [<ffffffff810f9e0c>] ? __do_fault+0x338/0x36b
 [<ffffffff81713820>] ? verify_iovec+0x44/0x94
 [<ffffffff81709e63>] ? ___sys_sendmsg+0x1f1/0x283
 [<ffffffff81140a73>] ? __inode_wait_for_writeback+0x67/0xae
 [<ffffffff8111735e>] ? __cache_free.isra.46+0x178/0x187
 [<ffffffff811173b1>] ? kmem_cache_free+0x44/0x84
 [<ffffffff81132c22>] ? dentry_kill+0x13d/0x149
 [<ffffffff81132f6f>] ? dput+0xe5/0xef
 [<ffffffff81136e04>] ? fget_light+0x2e/0x7c
 [<ffffffff8170ae62>] ? __sys_sendmsg+0x39/0x57
 [<ffffffff818a7e39>] ? system_call_fastpath+0x16/0x1b
---[ end trace 1b3eb79359c1d1e6 ]---
Reported-by: NSander Eikelenboom <linux@eikelenboom.it>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Integers need to be multiplied before division.
Signed-off-by: NDavid Spinadel <david.spinadel@intel.com>
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The fw_rx_stats entry in debugfs was getting truncated because the
internal buffer used to hold the string was too short.  The
calculation of the needed buffer size was rather bogus.

Simplify the calculation by multiplying the number of entries in the
entire structure by the size of each data line and adding the size of
the header lines.

Additionally, add the mac_id value, which was missing.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The activity grading indication from the firmware should
not be used in this case, but the bt_status in the firwmare
notification.
Fix that.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The firmware always expects the Coex Mode to be set.
Moreover, the firmware expects bit 0 is the valid bits to
be set all the times.
I misunderstood the API and didn't set these bits when
commands are sent to update the paramters of the Coex. As
a result, the firmware understood that the BT Coex was
disabled (Coex mode = 0) and ignored all the updates (valid
bit 0 clear).

Fix that.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Section size limitation to 6000 is incorrect.
NVM file need to support bigger sections in order
to support PAPD tables.
Signed-off-by: NIdan Kahlon <idanx.kahlon@intel.com>
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Reviewed-by: NMaor Perez <maorx.perez@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Support Signed firmware based on code signing system (CSS)
protocol and dual CPUs download,
the code recognize if there are more than one CPU and
if we need to operate the signed protocol according to
the ucode binary image
Signed-off-by: NEran Harary <eran.harary@intel.com>
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

This fix is related to a scan request when associated (bgscan).
FW expects suspend time parameter in micro seconds while the driver
provides a value in time units. This bug leads to a high traffic
latency when scan is requested while traffic is in progress.
Signed-off-by: NAlexander Bondar <alexander.bondar@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

At the firmware level, IBSS support has similar programming
requirements as AP/GO support, so use the same functions with
just small differences.

With IBSS only a single virtual interface can be used, so no
changes in the advertised interface combinations are needed.

For now, don't use hardware crypto for the GTKs in IBSS mode,
the firmware should support it though.
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

7265 is a very similar device to 7260, so just add
the definitions based on 7260 for it.
Signed-off-by: NEran Harary <eran.harary@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

When we restart firmware and it is marked as not alive, we can still get
calls from mac80211. Don't WARN on in this situation as this triggers
automatic bug reports with no valuable information.

This continuation of:

commit 8ca95995
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Sun Sep 15 11:37:17 2013 +0300

    iwlwifi: don't WARN on host commands sent when firmware is dead

which remove WARN_ONCE from one place, but those warnings are also
triggered from other functions.

Patch also adds unlikely() statement.
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

In certain corner cases in the firmware implementation, powersave
transitions can cause the firmware to miss the fact that commands
were added to the queue/FIFO and thus never processes them. Since
the commands really are in the queue, try to poke the firmware in
such cases (by grabbing NIC access, which wakes up the NIC) so it
notices the new command and processes it.
Reviewed-by: NAlexander Bondar <alexander.bondar@intel.com>
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Remove code that is not needed and always allow MIMO when
in tight mode. In loose mode, we should avoid MIMO since BT
can use the other antenna to Rx while we Tx.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The code limiting the AMPDU length due to BT traffic was
duplicated. Remove the redundant code.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Tests have shown that we should start AMPDU even when BT
is active. So remove that constraint.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Tests have shown that we should go SMSP_STATIC when BT
traffic is high, and stay in dynamic if BT traffic is low.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

BT Coex needs to be updated when the bandwidth is modified
by the AP.
While at it, remove the vif parameter from
bt_coex_vif_change since it was unused.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Until now, after WoWLAN, we weren't able to keep the
connection to the AP because the firmware didn't give
us the right information. Since the firmware API has
been changed to include all the information we need,
change the driver to work with the new API (if it is
available) and program all the relevant information
in mac80211 to keep the connection.
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Some NICs embedded in platforms that have only 16 Tx queues,
this affect the mapping of the Tx queues.
Signed-off-by: NEytan Lifshitz <eytan.lifshitz@intel.com>
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Reviewed-by: NGregory Greenman <gregory.greenman@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Some NICs aren't allowed to be powered up at driver load time.
Fix it, and move the external NVM loading from driver load time to
driver up time (parsing the external nvm file remains at driver load time).
Signed-off-by: NEytan Lifshitz <eytan.lifshitz@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

FW starts using legacy power table command (0x77) for device wide power
settings. Currently this command contains only option flags field.
It can configure the following: CAM (Continuous Active Mode) and
POWER_SAVE_ENABLE debug option. Send this command when firmware is
loaded - D0 and D3.
Note: Setting this command is important to avoid unwanted FW behavior.
It particularly fixes a bug when a device does not drop to low power
after disassociation from AP.
Signed-off-by: NAlexander Bondar <alexander.bondar@intel.com>
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

This should really not happen. If it does, restarting is the
only way to recover since the driver and the firmware might
very well be out of sync. Moreover, iwl_op_mode_nic_error
will print data that might help debugging.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Single shared antenna devices need a special LUT.
Address this need.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

In loose BT Coex scheme, the aggregation size doesn't need to
be limited.

To avoid triggering it, remove a lockdep assertion - we need
to compute the AMPDU size limit from rate control code which
can't take mvm->mutex. This means that there is a race but in
the worst case, we will have a wrong AMPDU size limit which
is not a big issue.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The merge b35c8097 seems to have lost commit eabc4ac5,
put the code back.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The driver core clears the driver data to NULL after device_release
or on probe failure. Thus, it is not needed to manually clear the
device driver data to NULL.
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

In RF KILL the init ucode is running, but don't complete
all its tasks, so we need to run the init ucode again.
Change the flag name to init_ucode_complete, to be more appropriate.
Signed-off-by: NEytan Lifshitz <eytan.lifshitz@intel.com>
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The firmware API for IPv6 NDP/NS offload has changed again.
Implement support for the new API; this requires calculating
the solicited node address for each "target" address as it's
no longer ignored by the firmware.
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Rssi events were enabled on interfaces using 5.2GHz.
Interfaces on 5.2GHz were taken into account while
determining the ACK / CTS kill mask. Fix that.

The last rssi notified to BT Coex was reset every BT Coex
Notification. Since we get a lot of these notifications
from the firmware, we reset the rssi all the time which
means that the bt_rssi_event is called all the time.
Fix that by puting the rssi we pull upon BT Coex
notification into iwl_mvm_vif_bf_data.last_bt_coex_event
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>