--- /dev/null
+From 540623caa6c769d9d19e6044949f5fa2fe1a33a6 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Mon, 23 Feb 2015 02:40:07 +0200
+Subject: iwlwifi: fix max_ht_ampdu_exponent for older devices
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 540623caa6c769d9d19e6044949f5fa2fe1a33a6 upstream.
+
+The commit below didn't update the max_ht_ampdu_exponent
+for the devices listed in iwl-[1-6]000.c which, in result,
+became 0 instead of 8K. This reduced the size of the Rx
+AMPDU from 64K to 8K which had an impact in the Rx
+throughput. One user reported that because of this, his
+downstream throughput droppped by a half.
+
+Fixes: c064ddf318aa ("iwlwifi: change max HT and VHT A-MPDU exponent")
+Reported-and-tested-by: Valentin Manea <linux-wireless@mrs.ro>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-1000.c | 6 ++++--
+ drivers/net/wireless/iwlwifi/iwl-2000.c | 13 +++++++++----
+ drivers/net/wireless/iwlwifi/iwl-5000.c | 6 ++++--
+ drivers/net/wireless/iwlwifi/iwl-6000.c | 18 ++++++++++++------
+ 4 files changed, 29 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
+@@ -95,7 +95,8 @@ static const struct iwl_eeprom_params iw
+ .nvm_calib_ver = EEPROM_1000_TX_POWER_VERSION, \
+ .base_params = &iwl1000_base_params, \
+ .eeprom_params = &iwl1000_eeprom_params, \
+- .led_mode = IWL_LED_BLINK
++ .led_mode = IWL_LED_BLINK, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl1000_bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N 1000 BGN",
+@@ -121,7 +122,8 @@ const struct iwl_cfg iwl1000_bg_cfg = {
+ .base_params = &iwl1000_base_params, \
+ .eeprom_params = &iwl1000_eeprom_params, \
+ .led_mode = IWL_LED_RF_STATE, \
+- .rx_with_siso_diversity = true
++ .rx_with_siso_diversity = true, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl100_bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N 100 BGN",
+--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
+@@ -123,7 +123,9 @@ static const struct iwl_eeprom_params iw
+ .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION, \
+ .base_params = &iwl2000_base_params, \
+ .eeprom_params = &iwl20x0_eeprom_params, \
+- .led_mode = IWL_LED_RF_STATE
++ .led_mode = IWL_LED_RF_STATE, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
++
+
+ const struct iwl_cfg iwl2000_2bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N 2200 BGN",
+@@ -149,7 +151,8 @@ const struct iwl_cfg iwl2000_2bgn_d_cfg
+ .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION, \
+ .base_params = &iwl2030_base_params, \
+ .eeprom_params = &iwl20x0_eeprom_params, \
+- .led_mode = IWL_LED_RF_STATE
++ .led_mode = IWL_LED_RF_STATE, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl2030_2bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N 2230 BGN",
+@@ -170,7 +173,8 @@ const struct iwl_cfg iwl2030_2bgn_cfg =
+ .base_params = &iwl2000_base_params, \
+ .eeprom_params = &iwl20x0_eeprom_params, \
+ .led_mode = IWL_LED_RF_STATE, \
+- .rx_with_siso_diversity = true
++ .rx_with_siso_diversity = true, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl105_bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N 105 BGN",
+@@ -197,7 +201,8 @@ const struct iwl_cfg iwl105_bgn_d_cfg =
+ .base_params = &iwl2030_base_params, \
+ .eeprom_params = &iwl20x0_eeprom_params, \
+ .led_mode = IWL_LED_RF_STATE, \
+- .rx_with_siso_diversity = true
++ .rx_with_siso_diversity = true, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl135_bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N 135 BGN",
+--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
+@@ -93,7 +93,8 @@ static const struct iwl_eeprom_params iw
+ .nvm_calib_ver = EEPROM_5000_TX_POWER_VERSION, \
+ .base_params = &iwl5000_base_params, \
+ .eeprom_params = &iwl5000_eeprom_params, \
+- .led_mode = IWL_LED_BLINK
++ .led_mode = IWL_LED_BLINK, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl5300_agn_cfg = {
+ .name = "Intel(R) Ultimate N WiFi Link 5300 AGN",
+@@ -158,7 +159,8 @@ const struct iwl_cfg iwl5350_agn_cfg = {
+ .base_params = &iwl5000_base_params, \
+ .eeprom_params = &iwl5000_eeprom_params, \
+ .led_mode = IWL_LED_BLINK, \
+- .internal_wimax_coex = true
++ .internal_wimax_coex = true, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl5150_agn_cfg = {
+ .name = "Intel(R) WiMAX/WiFi Link 5150 AGN",
+--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
+@@ -145,7 +145,8 @@ static const struct iwl_eeprom_params iw
+ .nvm_calib_ver = EEPROM_6005_TX_POWER_VERSION, \
+ .base_params = &iwl6000_g2_base_params, \
+ .eeprom_params = &iwl6000_eeprom_params, \
+- .led_mode = IWL_LED_RF_STATE
++ .led_mode = IWL_LED_RF_STATE, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl6005_2agn_cfg = {
+ .name = "Intel(R) Centrino(R) Advanced-N 6205 AGN",
+@@ -199,7 +200,8 @@ const struct iwl_cfg iwl6005_2agn_mow2_c
+ .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION, \
+ .base_params = &iwl6000_g2_base_params, \
+ .eeprom_params = &iwl6000_eeprom_params, \
+- .led_mode = IWL_LED_RF_STATE
++ .led_mode = IWL_LED_RF_STATE, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl6030_2agn_cfg = {
+ .name = "Intel(R) Centrino(R) Advanced-N 6230 AGN",
+@@ -235,7 +237,8 @@ const struct iwl_cfg iwl6030_2bg_cfg = {
+ .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION, \
+ .base_params = &iwl6000_g2_base_params, \
+ .eeprom_params = &iwl6000_eeprom_params, \
+- .led_mode = IWL_LED_RF_STATE
++ .led_mode = IWL_LED_RF_STATE, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl6035_2agn_cfg = {
+ .name = "Intel(R) Centrino(R) Advanced-N 6235 AGN",
+@@ -290,7 +293,8 @@ const struct iwl_cfg iwl130_bg_cfg = {
+ .nvm_calib_ver = EEPROM_6000_TX_POWER_VERSION, \
+ .base_params = &iwl6000_base_params, \
+ .eeprom_params = &iwl6000_eeprom_params, \
+- .led_mode = IWL_LED_BLINK
++ .led_mode = IWL_LED_BLINK, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl6000i_2agn_cfg = {
+ .name = "Intel(R) Centrino(R) Advanced-N 6200 AGN",
+@@ -322,7 +326,8 @@ const struct iwl_cfg iwl6000i_2bg_cfg =
+ .base_params = &iwl6050_base_params, \
+ .eeprom_params = &iwl6000_eeprom_params, \
+ .led_mode = IWL_LED_BLINK, \
+- .internal_wimax_coex = true
++ .internal_wimax_coex = true, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl6050_2agn_cfg = {
+ .name = "Intel(R) Centrino(R) Advanced-N + WiMAX 6250 AGN",
+@@ -347,7 +352,8 @@ const struct iwl_cfg iwl6050_2abg_cfg =
+ .base_params = &iwl6050_base_params, \
+ .eeprom_params = &iwl6000_eeprom_params, \
+ .led_mode = IWL_LED_BLINK, \
+- .internal_wimax_coex = true
++ .internal_wimax_coex = true, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl6150_bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N + WiMAX 6150 BGN",
--- /dev/null
+From 4cd4b50cc2429294c23a1998c33fdfd804db0f37 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Thu, 5 Mar 2015 13:43:15 +0200
+Subject: iwlwifi: mvm: BT Coex - fix a NULL pointer exception
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 4cd4b50cc2429294c23a1998c33fdfd804db0f37 upstream.
+
+The commit below introduced an unsafe dereference of
+mvmvif->phy_ctxt. It can be NULL even if we hold the mutex.
+We can be handling a BT Coex notification while the vif has
+already been unassigned. This can happen since the BT Coex
+notification is hanled asynchronuously: we can have started
+to handle the BT Coex notification trying to acquire the
+mutex while the unassign flow already got it. The BT Coex
+notification handling will wait for the mutext. I'll get it
+later, but then mvmvif->phy_ctxt will be NULL.
+
+Panic log:
+
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [<f985180d>] iwl_mvm_bt_notif_iterator+0x9d/0x340 [iwlmvm]
+*pdpt = 0000000000000000 *pde = f000eef300000007
+Oops: 0000 [#1] SMP
+Workqueue: events iwl_mvm_async_handlers_wk [iwlmvm]
+task: ed719b20 ti: ec03e000 task.ti: ec03e000
+EIP: 0060:[<f985180d>] EFLAGS: 00010202 CPU: 2
+EIP is at iwl_mvm_bt_notif_iterator+0x9d/0x340 [iwlmvm]
+EAX: 00000000 EBX: f6d3cb70 ECX: f6d3cb70 EDX: 00000000
+ESI: ec03fe40 EDI: efeb8810 EBP: ec03fdf0 ESP: ec03fdac
+ DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
+CR0: 80050033 CR2: 00000000 CR3: 01a1a000 CR4: 001407f0
+Stack:
+ f743ca80 f744a404 ec03fdcc c10e3952 00003aba f743ca80 00000246 f743ca80
+ 00000246 00000000 00000001 00000000 ebd45ff6 ebd458a4 f6d3c500 ebd45578
+ ebd44b01 ec03fe18 f99e1bc2 00000002 ebd44bc0 f9851770 00000000 f6d3c500
+Call Trace:
+ [<c10e3952>] ? ring_buffer_unlock_commit+0xa2/0xd0
+ [<f99e1bc2>] __iterate_interfaces+0x82/0x110 [mac80211]
+ [<f9851770>] ? iwl_mvm_bt_coex_reduced_txp+0x140/0x140 [iwlmvm]
+ [<f99e1c6a>] ieee80211_iterate_active_interfaces_atomic+0x1a/0x20 [mac80211]
+ [<f9851427>] iwl_mvm_bt_coex_notif_handle+0x77/0x280 [iwlmvm]
+ [<f9852161>] iwl_mvm_rx_bt_coex_notif_old+0x211/0x220 [iwlmvm]
+ [<f9850b8b>] iwl_mvm_rx_bt_coex_notif+0x19b/0x1b0 [iwlmvm]
+ [<f983944f>] iwl_mvm_async_handlers_wk+0x7f/0xe0 [iwlmvm]
+
+Fixes: 123f515635b1 ("iwlwifi: mvm: BT Coex - add support for TTC / RRC")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/coex.c | 3 ++-
+ drivers/net/wireless/iwlwifi/mvm/coex_legacy.c | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
++++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
+@@ -793,7 +793,8 @@ static void iwl_mvm_bt_notif_iterator(vo
+ if (!vif->bss_conf.assoc)
+ smps_mode = IEEE80211_SMPS_AUTOMATIC;
+
+- if (IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
++ if (mvmvif->phy_ctxt &&
++ IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
+ mvmvif->phy_ctxt->id))
+ smps_mode = IEEE80211_SMPS_AUTOMATIC;
+
+--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
++++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+@@ -832,7 +832,8 @@ static void iwl_mvm_bt_notif_iterator(vo
+ if (!vif->bss_conf.assoc)
+ smps_mode = IEEE80211_SMPS_AUTOMATIC;
+
+- if (data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
++ if (mvmvif->phy_ctxt &&
++ data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
+ smps_mode = IEEE80211_SMPS_AUTOMATIC;
+
+ IWL_DEBUG_COEX(data->mvm,
--- /dev/null
+From 833d9b9785b3eedfaf2c869a6a63deba88058599 Mon Sep 17 00:00:00 2001
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Date: Sun, 15 Feb 2015 18:33:23 +0200
+Subject: iwlwifi: mvm: Fix ROC removal
+
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+
+commit 833d9b9785b3eedfaf2c869a6a63deba88058599 upstream.
+
+iwl_mvm_stop_roc removes TE only if running flag is set. This is not correct
+since this flag is only set when the TE is started.
+This resulted in a TE not being removed, when mac80211 believes that there are
+no active ROCs.
+
+Fixes: bf5da87f60a9 ("iwlwifi: mvm: add remove flow for AUX ROC time events")
+Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Reviewed-by: Matti Gottlieb <matti.gottlieb@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/time-event.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
++++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
+@@ -750,8 +750,7 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mv
+ * request
+ */
+ list_for_each_entry(te_data, &mvm->time_event_list, list) {
+- if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE &&
+- te_data->running) {
++ if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
+ mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
+ is_p2p = true;
+ goto remove_te;
+@@ -766,10 +765,8 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mv
+ * request
+ */
+ list_for_each_entry(te_data, &mvm->aux_roc_te_list, list) {
+- if (te_data->running) {
+- mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
+- goto remove_te;
+- }
++ mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
++ goto remove_te;
+ }
+
+ remove_te:
--- /dev/null
+From 57bff1485096c53f943e26b1c5847f2a9dfe84db Mon Sep 17 00:00:00 2001
+From: Eyal Shapira <eyal@wizery.com>
+Date: Mon, 2 Feb 2015 15:21:27 +0200
+Subject: iwlwifi: mvm: rs: fix BT Coex check to look at the correct ant
+
+From: Eyal Shapira <eyal@wizery.com>
+
+commit 57bff1485096c53f943e26b1c5847f2a9dfe84db upstream.
+
+The check to avoid the shared antenna was passed the wrong
+antenna parameter. It should have checked whether the antenna of
+the next column we're considering is allowed and instead it was
+passed the current antenna.
+This could lead to a wrong choice of the next column in the rs
+algorithm and non optimal performance.
+
+Fixes: commit 219fb66b49fac64bb ("iwlwifi: mvm: rs - don't use the shared antenna when BT load is high")
+Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/rs.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
+@@ -146,9 +146,12 @@ enum rs_column_mode {
+ #define MAX_NEXT_COLUMNS 7
+ #define MAX_COLUMN_CHECKS 3
+
++struct rs_tx_column;
++
+ typedef bool (*allow_column_func_t) (struct iwl_mvm *mvm,
+ struct ieee80211_sta *sta,
+- struct iwl_scale_tbl_info *tbl);
++ struct iwl_scale_tbl_info *tbl,
++ const struct rs_tx_column *next_col);
+
+ struct rs_tx_column {
+ enum rs_column_mode mode;
+@@ -159,13 +162,15 @@ struct rs_tx_column {
+ };
+
+ static bool rs_ant_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- struct iwl_scale_tbl_info *tbl)
++ struct iwl_scale_tbl_info *tbl,
++ const struct rs_tx_column *next_col)
+ {
+- return iwl_mvm_bt_coex_is_ant_avail(mvm, tbl->rate.ant);
++ return iwl_mvm_bt_coex_is_ant_avail(mvm, next_col->ant);
+ }
+
+ static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- struct iwl_scale_tbl_info *tbl)
++ struct iwl_scale_tbl_info *tbl,
++ const struct rs_tx_column *next_col)
+ {
+ if (!sta->ht_cap.ht_supported)
+ return false;
+@@ -183,7 +188,8 @@ static bool rs_mimo_allow(struct iwl_mvm
+ }
+
+ static bool rs_siso_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- struct iwl_scale_tbl_info *tbl)
++ struct iwl_scale_tbl_info *tbl,
++ const struct rs_tx_column *next_col)
+ {
+ if (!sta->ht_cap.ht_supported)
+ return false;
+@@ -192,7 +198,8 @@ static bool rs_siso_allow(struct iwl_mvm
+ }
+
+ static bool rs_sgi_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- struct iwl_scale_tbl_info *tbl)
++ struct iwl_scale_tbl_info *tbl,
++ const struct rs_tx_column *next_col)
+ {
+ struct rs_rate *rate = &tbl->rate;
+ struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
+@@ -1594,7 +1601,7 @@ static enum rs_column rs_get_next_column
+
+ for (j = 0; j < MAX_COLUMN_CHECKS; j++) {
+ allow_func = next_col->checks[j];
+- if (allow_func && !allow_func(mvm, sta, tbl))
++ if (allow_func && !allow_func(mvm, sta, tbl, next_col))
+ break;
+ }
+
--- /dev/null
+From 0f611d28fc2e13cfec64e1c544c16a086886805a Mon Sep 17 00:00:00 2001
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Date: Thu, 12 Mar 2015 08:53:30 +0200
+Subject: mac80211: count interfaces correctly for combination checks
+
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+
+commit 0f611d28fc2e13cfec64e1c544c16a086886805a upstream.
+
+Since moving the interface combination checks to mac80211, it's
+broken because it now only considers interfaces with an assigned
+channel context, so for example any interface that isn't active
+can still be up, which is clearly an issue; also, in particular
+P2P-Device wdevs are an issue since they never have a chanctx.
+
+Fix this by counting running interfaces instead the ones with a
+channel context assigned.
+
+Fixes: 73de86a38962b ("cfg80211/mac80211: move interface counting for combination check to mac80211")
+Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+[rewrite commit message, dig out the commit it fixes]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -3153,7 +3153,7 @@ int ieee80211_check_combinations(struct
+ wdev_iter = &sdata_iter->wdev;
+
+ if (sdata_iter == sdata ||
+- rcu_access_pointer(sdata_iter->vif.chanctx_conf) == NULL ||
++ !ieee80211_sdata_running(sdata_iter) ||
+ local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
+ continue;
+
--- /dev/null
+From aa75ebc275b2a91b193654a177daf900ad6703f0 Mon Sep 17 00:00:00 2001
+From: Michal Kazior <michal.kazior@tieto.com>
+Date: Tue, 10 Feb 2015 12:48:44 +0100
+Subject: mac80211: disable u-APSD queues by default
+
+From: Michal Kazior <michal.kazior@tieto.com>
+
+commit aa75ebc275b2a91b193654a177daf900ad6703f0 upstream.
+
+Some APs experience problems when working with
+U-APSD. Decreasing the probability of that
+happening by using legacy mode for all ACs but VO
+isn't enough.
+
+Cisco 4410N originally forced us to enable VO by
+default only because it treated non-VO ACs as
+legacy.
+
+However some APs (notably Netgear R7000) silently
+reclassify packets to different ACs. Since u-APSD
+ACs require trigger frames for frame retrieval
+clients would never see some frames (e.g. ARP
+responses) or would fetch them accidentally after
+a long time.
+
+It makes little sense to enable u-APSD queues by
+default because it needs userspace applications to
+be aware of it to actually take advantage of the
+possible additional powersavings. Implicitly
+depending on driver autotrigger frame support
+doesn't make much sense.
+
+Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/ieee80211_i.h | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -58,13 +58,24 @@ struct ieee80211_local;
+ #define IEEE80211_UNSET_POWER_LEVEL INT_MIN
+
+ /*
+- * Some APs experience problems when working with U-APSD. Decrease the
+- * probability of that happening by using legacy mode for all ACs but VO.
+- * The AP that caused us trouble was a Cisco 4410N. It ignores our
+- * setting, and always treats non-VO ACs as legacy.
++ * Some APs experience problems when working with U-APSD. Decreasing the
++ * probability of that happening by using legacy mode for all ACs but VO isn't
++ * enough.
++ *
++ * Cisco 4410N originally forced us to enable VO by default only because it
++ * treated non-VO ACs as legacy.
++ *
++ * However some APs (notably Netgear R7000) silently reclassify packets to
++ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval
++ * clients would never see some frames (e.g. ARP responses) or would fetch them
++ * accidentally after a long time.
++ *
++ * It makes little sense to enable u-APSD queues by default because it needs
++ * userspace applications to be aware of it to actually take advantage of the
++ * possible additional powersavings. Implicitly depending on driver autotrigger
++ * frame support doesn't make much sense.
+ */
+-#define IEEE80211_DEFAULT_UAPSD_QUEUES \
+- IEEE80211_WMM_IE_STA_QOSINFO_AC_VO
++#define IEEE80211_DEFAULT_UAPSD_QUEUES 0
+
+ #define IEEE80211_DEFAULT_MAX_SP_LEN \
+ IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
--- /dev/null
+From d0c22119f574b851e63360c6b8660fe9593bbc3c Mon Sep 17 00:00:00 2001
+From: Bob Copeland <me@bobcopeland.com>
+Date: Mon, 2 Mar 2015 14:28:52 -0500
+Subject: mac80211: drop unencrypted frames in mesh fwding
+
+From: Bob Copeland <me@bobcopeland.com>
+
+commit d0c22119f574b851e63360c6b8660fe9593bbc3c upstream.
+
+The mesh forwarding path was not checking that data
+frames were protected when running an encrypted network;
+add the necessary check.
+
+Reported-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/rx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2191,6 +2191,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ hdr = (struct ieee80211_hdr *) skb->data;
+ mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+
++ if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
++ return RX_DROP_MONITOR;
++
+ /* frame is in RMC, don't forward */
+ if (ieee80211_is_data(hdr->frame_control) &&
+ is_multicast_ether_addr(hdr->addr1) &&
--- /dev/null
+From 496fcc294daab18799e190c0264863d653588d1f Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 12 Mar 2015 08:53:27 +0200
+Subject: nl80211: ignore HT/VHT capabilities without QoS/WMM
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 496fcc294daab18799e190c0264863d653588d1f upstream.
+
+As HT/VHT depend heavily on QoS/WMM, it's not a good idea to
+let userspace add clients that have HT/VHT but not QoS/WMM.
+Since it does so in certain cases we've observed (client is
+using HT IEs but not QoS/WMM) just ignore the HT/VHT info at
+this point and don't pass it down to the drivers which might
+unconditionally use it.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/nl80211.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -4360,6 +4360,16 @@ static int nl80211_new_station(struct sk
+ if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
+ return -EINVAL;
+
++ /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
++ * as userspace might just pass through the capabilities from the IEs
++ * directly, rather than enforcing this restriction and returning an
++ * error in this case.
++ */
++ if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
++ params.ht_capa = NULL;
++ params.vht_capa = NULL;
++ }
++
+ /* When you run into this, adjust the code below for the new flag */
+ BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
+
--- /dev/null
+From d474a4d365aaa5c7aabcf11a74ea43aa23f6f2e9 Mon Sep 17 00:00:00 2001
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Date: Fri, 13 Mar 2015 03:48:56 -0700
+Subject: powercap / RAPL: handle domains with different energy units
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+commit d474a4d365aaa5c7aabcf11a74ea43aa23f6f2e9 upstream.
+
+The current driver assumes all RAPL domains within a CPU package
+have the same energy unit. This is no longer true for HSW server
+CPUs since DRAM domain has is own fixed energy unit which can be
+different than the package energy unit enumerated by package
+power MSR. In fact, the default HSW EP package power unit is 61uJ
+whereas DRAM domain unit is 15.3uJ. The result is that DRAM power
+consumption is counted 4x more than real power reported by energy
+counters, similarly for max_energy_range_uj of DRAM domain.
+
+This patch adds domain specific energy unit per cpu type, it allows
+domain energy unit to override package energy unit if non zero.
+
+Please see this document for details.
+"Intel Xeon Processor E5-1600 and E5-2600 v3 Product Families, Volume 2 of 2.
+ Datasheet, September 2014, Reference Number: 330784-001 "
+
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/powercap/intel_rapl.c | 54 ++++++++++++++++++++++++++++++------------
+ 1 file changed, 39 insertions(+), 15 deletions(-)
+
+--- a/drivers/powercap/intel_rapl.c
++++ b/drivers/powercap/intel_rapl.c
+@@ -73,7 +73,7 @@
+
+ #define TIME_WINDOW_MAX_MSEC 40000
+ #define TIME_WINDOW_MIN_MSEC 250
+-
++#define ENERGY_UNIT_SCALE 1000 /* scale from driver unit to powercap unit */
+ enum unit_type {
+ ARBITRARY_UNIT, /* no translation */
+ POWER_UNIT,
+@@ -158,6 +158,7 @@ struct rapl_domain {
+ struct rapl_power_limit rpl[NR_POWER_LIMITS];
+ u64 attr_map; /* track capabilities */
+ unsigned int state;
++ unsigned int domain_energy_unit;
+ int package_id;
+ };
+ #define power_zone_to_rapl_domain(_zone) \
+@@ -190,6 +191,7 @@ struct rapl_defaults {
+ void (*set_floor_freq)(struct rapl_domain *rd, bool mode);
+ u64 (*compute_time_window)(struct rapl_package *rp, u64 val,
+ bool to_raw);
++ unsigned int dram_domain_energy_unit;
+ };
+ static struct rapl_defaults *rapl_defaults;
+
+@@ -227,7 +229,8 @@ static int rapl_read_data_raw(struct rap
+ static int rapl_write_data_raw(struct rapl_domain *rd,
+ enum rapl_primitives prim,
+ unsigned long long value);
+-static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
++static u64 rapl_unit_xlate(struct rapl_domain *rd, int package,
++ enum unit_type type, u64 value,
+ int to_raw);
+ static void package_power_limit_irq_save(int package_id);
+
+@@ -305,7 +308,9 @@ static int get_energy_counter(struct pow
+
+ static int get_max_energy_counter(struct powercap_zone *pcd_dev, u64 *energy)
+ {
+- *energy = rapl_unit_xlate(0, ENERGY_UNIT, ENERGY_STATUS_MASK, 0);
++ struct rapl_domain *rd = power_zone_to_rapl_domain(pcd_dev);
++
++ *energy = rapl_unit_xlate(rd, 0, ENERGY_UNIT, ENERGY_STATUS_MASK, 0);
+ return 0;
+ }
+
+@@ -639,6 +644,11 @@ static void rapl_init_domains(struct rap
+ rd->msrs[4] = MSR_DRAM_POWER_INFO;
+ rd->rpl[0].prim_id = PL1_ENABLE;
+ rd->rpl[0].name = pl1_name;
++ rd->domain_energy_unit =
++ rapl_defaults->dram_domain_energy_unit;
++ if (rd->domain_energy_unit)
++ pr_info("DRAM domain energy unit %dpj\n",
++ rd->domain_energy_unit);
+ break;
+ }
+ if (mask) {
+@@ -648,11 +658,13 @@ static void rapl_init_domains(struct rap
+ }
+ }
+
+-static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
++static u64 rapl_unit_xlate(struct rapl_domain *rd, int package,
++ enum unit_type type, u64 value,
+ int to_raw)
+ {
+ u64 units = 1;
+ struct rapl_package *rp;
++ u64 scale = 1;
+
+ rp = find_package_by_id(package);
+ if (!rp)
+@@ -663,7 +675,12 @@ static u64 rapl_unit_xlate(int package,
+ units = rp->power_unit;
+ break;
+ case ENERGY_UNIT:
+- units = rp->energy_unit;
++ scale = ENERGY_UNIT_SCALE;
++ /* per domain unit takes precedence */
++ if (rd && rd->domain_energy_unit)
++ units = rd->domain_energy_unit;
++ else
++ units = rp->energy_unit;
+ break;
+ case TIME_UNIT:
+ return rapl_defaults->compute_time_window(rp, value, to_raw);
+@@ -673,11 +690,11 @@ static u64 rapl_unit_xlate(int package,
+ };
+
+ if (to_raw)
+- return div64_u64(value, units);
++ return div64_u64(value, units) * scale;
+
+ value *= units;
+
+- return value;
++ return div64_u64(value, scale);
+ }
+
+ /* in the order of enum rapl_primitives */
+@@ -773,7 +790,7 @@ static int rapl_read_data_raw(struct rap
+ final = value & rp->mask;
+ final = final >> rp->shift;
+ if (xlate)
+- *data = rapl_unit_xlate(rd->package_id, rp->unit, final, 0);
++ *data = rapl_unit_xlate(rd, rd->package_id, rp->unit, final, 0);
+ else
+ *data = final;
+
+@@ -799,7 +816,7 @@ static int rapl_write_data_raw(struct ra
+ "failed to read msr 0x%x on cpu %d\n", msr, cpu);
+ return -EIO;
+ }
+- value = rapl_unit_xlate(rd->package_id, rp->unit, value, 1);
++ value = rapl_unit_xlate(rd, rd->package_id, rp->unit, value, 1);
+ msr_val &= ~rp->mask;
+ msr_val |= value << rp->shift;
+ if (wrmsrl_safe_on_cpu(cpu, msr, msr_val)) {
+@@ -818,7 +835,7 @@ static int rapl_write_data_raw(struct ra
+ * calculate units differ on different CPUs.
+ * We convert the units to below format based on CPUs.
+ * i.e.
+- * energy unit: microJoules : Represented in microJoules by default
++ * energy unit: picoJoules : Represented in picoJoules by default
+ * power unit : microWatts : Represented in milliWatts by default
+ * time unit : microseconds: Represented in seconds by default
+ */
+@@ -834,7 +851,7 @@ static int rapl_check_unit_core(struct r
+ }
+
+ value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
+- rp->energy_unit = 1000000 / (1 << value);
++ rp->energy_unit = ENERGY_UNIT_SCALE * 1000000 / (1 << value);
+
+ value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
+ rp->power_unit = 1000000 / (1 << value);
+@@ -842,7 +859,7 @@ static int rapl_check_unit_core(struct r
+ value = (msr_val & TIME_UNIT_MASK) >> TIME_UNIT_OFFSET;
+ rp->time_unit = 1000000 / (1 << value);
+
+- pr_debug("Core CPU package %d energy=%duJ, time=%dus, power=%duW\n",
++ pr_debug("Core CPU package %d energy=%dpJ, time=%dus, power=%duW\n",
+ rp->id, rp->energy_unit, rp->time_unit, rp->power_unit);
+
+ return 0;
+@@ -859,7 +876,7 @@ static int rapl_check_unit_atom(struct r
+ return -ENODEV;
+ }
+ value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
+- rp->energy_unit = 1 << value;
++ rp->energy_unit = ENERGY_UNIT_SCALE * 1 << value;
+
+ value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
+ rp->power_unit = (1 << value) * 1000;
+@@ -867,7 +884,7 @@ static int rapl_check_unit_atom(struct r
+ value = (msr_val & TIME_UNIT_MASK) >> TIME_UNIT_OFFSET;
+ rp->time_unit = 1000000 / (1 << value);
+
+- pr_debug("Atom package %d energy=%duJ, time=%dus, power=%duW\n",
++ pr_debug("Atom package %d energy=%dpJ, time=%dus, power=%duW\n",
+ rp->id, rp->energy_unit, rp->time_unit, rp->power_unit);
+
+ return 0;
+@@ -1017,6 +1034,13 @@ static const struct rapl_defaults rapl_d
+ .compute_time_window = rapl_compute_time_window_core,
+ };
+
++static const struct rapl_defaults rapl_defaults_hsw_server = {
++ .check_unit = rapl_check_unit_core,
++ .set_floor_freq = set_floor_freq_default,
++ .compute_time_window = rapl_compute_time_window_core,
++ .dram_domain_energy_unit = 15300,
++};
++
+ static const struct rapl_defaults rapl_defaults_atom = {
+ .check_unit = rapl_check_unit_atom,
+ .set_floor_freq = set_floor_freq_atom,
+@@ -1037,7 +1061,7 @@ static const struct x86_cpu_id rapl_ids[
+ RAPL_CPU(0x3a, rapl_defaults_core),/* Ivy Bridge */
+ RAPL_CPU(0x3c, rapl_defaults_core),/* Haswell */
+ RAPL_CPU(0x3d, rapl_defaults_core),/* Broadwell */
+- RAPL_CPU(0x3f, rapl_defaults_core),/* Haswell */
++ RAPL_CPU(0x3f, rapl_defaults_hsw_server),/* Haswell servers */
+ RAPL_CPU(0x45, rapl_defaults_core),/* Haswell ULT */
+ RAPL_CPU(0x4C, rapl_defaults_atom),/* Braswell */
+ RAPL_CPU(0x4A, rapl_defaults_atom),/* Tangier */
input-synaptics-fix-middle-button-on-lenovo-2015-products.patch
input-synaptics-handle-spurious-release-of-trackstick-buttons.patch
input-synaptics-do-not-retrieve-the-board-id-on-old-firmwares.patch
+nl80211-ignore-ht-vht-capabilities-without-qos-wmm.patch
+mac80211-disable-u-apsd-queues-by-default.patch
+mac80211-drop-unencrypted-frames-in-mesh-fwding.patch
+mac80211-count-interfaces-correctly-for-combination-checks.patch
+powercap-rapl-handle-domains-with-different-energy-units.patch
+iwlwifi-mvm-rs-fix-bt-coex-check-to-look-at-the-correct-ant.patch
+iwlwifi-fix-max_ht_ampdu_exponent-for-older-devices.patch
+iwlwifi-mvm-bt-coex-fix-a-null-pointer-exception.patch
+iwlwifi-mvm-fix-roc-removal.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
