for_each_set_bit expect the size in number of bits and not
in bytes.

Fixes: a0f6bf2a ("iwlwifi: mvm: use private TFD queues for TDLS stations")
Reviewed-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The iwl_mvm_mac_get_queues_mask() added vif->hw_queue[ac] to the
queue mask although it might be set to IEEE80211_INVAL_HW_QUEUE.
Fix it.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

With this value, we de-facto disable the feature. Since it
is not working yet, disable it completely.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

C step functionality in the driver is exactly the same as
B step besides the ucode name that present as iwlwifi-8000C-xx.ucode
instead of iwlwifi-8000B-xx.ucode
Signed-off-by: Eran Harary <eran.harary@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The ref_lock that was recently added is missing initialization
which makes lockdep unhappy and is generally a bad idea.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Add a comment indicating that the WLAN_CIPHER_SUITE_WEP104 case falls
through to the WLAN_CIPHER_SUITE_WEP40 case in iwl_mvm_send_sta_key.
This will document that the lack of a break is intentional.

Coverity: CID 1260023
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Tx STBC was used only when in CAM mode or if powersave is disabled.
Effectively this meant we never used STBC as these modes aren't
used on most platforms by default. Change that.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

This is now implemented by mac80211 (commit below).
mac80211 will flush/drop the frames on the queues before
suspending / disconnecting.
It will then send the deauth and wait until the queues are
empty.

commit 3b24f4c6
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Wed Jan 7 15:42:39 2015 +0200

    mac80211: let flush() drop packets when possible

This reverts commit 4e6c48e0.

This new command will give finer granularity to configure
the platform.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

This allow to better preserve the BT performance while
WiFi is running.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Conflicts:
	drivers/net/wireless/iwlwifi/iwl-fw-file.h
	drivers/net/wireless/iwlwifi/mvm/scan.c

In order to change the usage of U-APSD on the fly later,
move the enabling condition into a new function that is
called when authenticated.

This allows the module parameter to become writable, it
won't take effect immediately but at least on the next
association the new value will be used.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Some further updates for net-next:
 * fix network-manager which was broken by the previous changes
 * fix delete-station events, which were broken by me making the
   genlmsg_end() mistake
 * fix a timer left running during suspend in some race conditions
   that would cause an annoying (but harmless) warning
 * (less important, but in the tree already) remove 80+80 MHz rate
   reporting since the spec doesn't distinguish it from 160 MHz;
   as the bitrate they're both 160 MHz bandwidth

If the firmware sends spontaneous DTS notfications with the
temperature (indicated in a TLV), we can ignore the temperature we get
in the RX statistics notifications.  This prevents potentially
handling the same temperature change twice.  It also ignores
notifications with temperature equal to 0 that happens from time to
time.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

These aren't useful and overflowing so drop them
and also fix a minor typo.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

There's no need to duplicate the structure field name in the string,
just generate the string in the macro that's there anyway. To keep
the debugfs output the same, rename one (otherwise unused) field.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The firmware API structs are split differently, synchronize
the struct splits with the current firmware definitions.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

When we want to trigger an NMI in the device, we need to set
bit 7 and not bit 0. However, older firmwares don't register
to the interrupt issued by bit 7. Use bit 7 first so that
the correct interrupt will be issued hoping that the firmware
will react. To be on the safe side, set bit 0 in case the
firmware didn't register to the proper interrupt.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

When the FW is in error status - try to read the RXF and
TXF (all of them) and add them to the dump data.

This shouldn't happen in non-error statuses, as we don't
want to stop the RXF/TXF while they are running.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Some HW modules have two SRAMs. In such cases add the secondary SRAM to
the list of dumped segments.
Signed-off-by: Ido Yariv <idox.yariv@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

As this functionality relies on getting a firmware notification
it is difficult to test. Allow accessing the data for it from
debugfs to be able to trigger all kinds of scenarios to test.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

A new host command can be used to configure the scheduler
instead of accessing the scheduler's registers from the
driver. This is easier and less error prone since accessing
the hardware at certain moments can lead to races with the
firmware.
Prefer to use the host command whenever it is available.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Use only basic dwell time (10 ms for active scan and 110 for passive),
regardless of the number of the probes and the band, if it is
supported by the FW. The FW will add 3 ms for each probe sent and 10
ms for low band channels.
Add a TLV flag to indicate such support in FW.

This fix is needed to fix few bugs regarding scans that take too much time.
Signed-off-by: David Spinadel <david.spinadel@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The driver doesn't support the firmwares that don't have
these capabilities. The code that actually used these
flags has been removed already, but the flags were left
for an unclear reason. Remove them.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Print the nvm version in the log for debugging purposes.
Signed-off-by: Eran Harary <eran.harary@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Fragmented scan should be applied for all channels, passive and active.
When scanning on passive channels the firmware uses frag_passive_dwell
to define the maximum continuous scan time before returning to the
operating channel. On active channels max_out_time is the parameter
used by the firmware to define the maximum time allowed out of the
operating channel. Since active channels' scan should also be fragmented
set max_out_time equal to frag_passive_dwell.
In addition:
- Set max_out_time and suspend_time if the firmware doesn't support
  fragmented scan to avoid unexpected behavior.
- Adjust max_out_time for second level of scan precedence.
Signed-off-by: Haim Dreyfuss <haim.dreyfuss@intel.com>
Reviewed-by: Alexander Bondar <alexander.bondar@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

This is to work around interoperability bugs with devices
that don't hanle MIMO properly.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

iwl_mvm_fw_dbg_collect allows to collect debug data from
the firmware. Most of the firmware interaction is done in
non-sleepable context. It makes little sense to force the
caller of iwl_mvm_fw_dbg_collect to sleep.
Defer the actual collection to a worker so that this
function will be able to be called from any context.
Reviewed-by: Eran Harary <eran.harary@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

In case platform is in d0i3 - make sure it is awake when
writing the registers to stop the monitor when collecting FW
debug data. Plus, remove unneeded mutex locking currently
done.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

This option enables scan offload iteration complete notification from
firmware which includes the last iteration's status and the scanned
channels from the current iteration.
Signed-off-by: Haim Dreyfuss <haim.dreyfuss@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Add a new config for 4165 series over PCI and insert support
for two new 4165 series PCI IDs.
Signed-off-by: Oren Givon <oren.givon@intel.com>
Reviewed-by: Liad Kaufman <liad.kaufman@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

This makes sure that we're not trying to read/write any of
the FW debug data collected during d0i3.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Reviewed-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Repeating the legacy rates avoids degrading quickly to
lower rates due to collisions which is common when doing
TCP Tx traffic in legacy.
This slightly improves TCP Tx throughput while working
in legacy in different scenarios.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

If Tx failed because the STA was in powersave there's no point
in sending a BAR so avoid indicating AMPDU_NO_BACK to mac80211.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

These are coming from the FW and are used to access arrays.
Bad values can cause an out of bounds access so discard
such ba_notifs and warn.

CC: <stable@vger.kernel.org> [3.10+]
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

While suspending, we destroy the authentication /
association that might be taking place. While doing so, we
forgot to delete the timer which can be firing after
local->suspended is already set, producing the warning below.

Fix that by deleting the timer.

[66722.825487] WARNING: CPU: 2 PID: 5612 at net/mac80211/util.c:755 ieee80211_can_queue_work.isra.18+0x32/0x40 [mac80211]()
[66722.825487] queueing ieee80211 work while going to suspend
[66722.825529] CPU: 2 PID: 5612 Comm: kworker/u16:69 Tainted: G        W  O  3.16.1+ #24
[66722.825537] Workqueue: events_unbound async_run_entry_fn
[66722.825545] Call Trace:
[66722.825552]  <IRQ>  [<ffffffff817edbb2>] dump_stack+0x4d/0x66
[66722.825556]  [<ffffffff81075cad>] warn_slowpath_common+0x7d/0xa0
[66722.825572]  [<ffffffffa06b5b90>] ? ieee80211_sta_bcn_mon_timer+0x50/0x50 [mac80211]
[66722.825573]  [<ffffffff81075d1c>] warn_slowpath_fmt+0x4c/0x50
[66722.825586]  [<ffffffffa06977a2>] ieee80211_can_queue_work.isra.18+0x32/0x40 [mac80211]
[66722.825598]  [<ffffffffa06977d5>] ieee80211_queue_work+0x25/0x50 [mac80211]
[66722.825611]  [<ffffffffa06b5bac>] ieee80211_sta_timer+0x1c/0x20 [mac80211]
[66722.825614]  [<ffffffff8108655a>] call_timer_fn+0x8a/0x300
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

This reverts commit ba1debdf.

Oliver reported that it breaks network-manager, for some reason with
this patch NM decides that the device isn't wireless but "generic"
(ethernet), sees no carrier (as expected with wifi) and fails to do
anything else with it.

Revert this to unbreak userspace.
Reported-by: Oliver Hartkopp <socketcan@hartkopp.net>
Tested-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

When we have an active scheduled scan, and the RFKILL
interrupt kicks in, the stack will cancel the scheduled
scan as part of the down flow. But cancelling scheduled
scan usually implies sending a command to the firwmare
which has been killed as part of the RFKILL interrupt
handling.
Because of that, we returned an error to mac80211 when
it asked to stop the scheduled scan and didn't notify the
end of the scheduled scan. Besides a fat warning, this led
to a situation in which cfg80211 would refuse any new scan
request.

To disentangle this, fake that the scheduled scan has been
stopped without sending the command to the firwmare, return
0 after having properly let cfg80211 know that the scan
has been cancelled.

This is basically the same as:
commit 9b520d84
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Tue Nov 4 15:54:11 2014 +0200

    iwlwifi: mvm: abort scan upon RFKILL

    This code existed but not for all the different FW APIs
    we support.
    Fix this.

but for the scheduled scan case.

Link: http://permalink.gmane.org/gmane.linux.kernel.wireless.general/133232Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The return value from nl80211_send_station() is the length of the
skb, or a negative error, so abort sending the message only when
the return value was negative.

This fixes the ibss_rsn wpa_supplicant test case.
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>