mac80211: drop control frames after processing

After ieee80211_rx_h_ctrl() processing we only
want to process management (including action)
frames, so there's no point in letting control
frames continue.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: remove useless work starting

Ever since we use only cfg80211 for configuration,
there is no configuration that could be pending at
this point, cfg80211 will have the configuration
that is pending and apply it afterwards.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: move WEP weak IV check

I suspect the compiler will do this optimisation
anyway, but it seems cleaner to move this into
the WEP switch case.

Also make rx_h_decrypt use a local variable for
the frame_control so that we don't need to reload
the hdr variable for this after linearizing.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: clean up ieee80211_stop_tx_ba_session

There's no sense in letting anything but internal
mac80211 functions set the initiator to anything
but WLAN_BACK_INITIATOR, since WLAN_BACK_RECIPIENT
is only valid when we have received a frame from
the peer, which we react to directly in mac80211.

The debugfs code I recently added got this wrong
as well.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: Add support for hardware ARP query filtering

Some hardware allow extended filtering of ARP frames not intended for
the host. To perform such filtering, the hardware needs to know the current
IP address(es) of the host, bound to its interface.

Add support for ARP filtering to mac80211 by adding a new op to the driver
interface, allowing to configure the current IP addresses. This op is called
upon association with the currently configured address(es), and when
associated whenever the IP address(es) change.

This patch adds configuration of IPv4 addresses only, as IPv6 addresses don't
need ARP filtering.

Signed-off-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: remove tx status ampdu_ack_map

There's a single use of this struct member, but
as it is write-only it clearly not necessary.
Thus we can free up some space here, even if we
don't need it right now it seems pointless to
carry around the variable.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: remove bogus mod_timer() call

The IBSS code has a bogus mod_timer(..., 0) call,
we shouldn't ever pass a constant value to the
function since any constant value could be in the
future or the past.

However, invoking the timer here is not necessary
at all, since we just finished scanning and just
need to have the IBSS code run again from the
workqueue later, so factor out the work starting
and use that instead.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: use the key handling code from ath9k_common instead of duplicating it

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_common: use allocated key cache entries for multi BSS crypto support

This patch replaces the buggy 'ath9k: Group Key fix for VAPs' change.

For AP mode group keys, use the BSSID as lookup mac address, with
the multicast keysearch bit set.
For IBSS mode, use the peer's MAC address with multicast keysearch.
For STA mode, keep using the group key slots.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_hw: add multicast key search support

If a MAC address for a key table entry is flagged with the
multicast bit (0x01), indicate to the hardware that multicast
lookup instead of unicast lookup should be used. The multicast
bit itself never makes it to the actual keytable entry register,
as it is shifted out.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ssb: fast powerup delay calculation for PMU capable devices

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Acked-by: Gábor Stefanik <netrolller.3d@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ssb: update PMU init to match specs

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Revert "iwlwifi: move _agn statistics related structure"

This reverts commit a2064b7a4a22d118087898e4308670da7ac07911.

when CONFIG_IWLAGN=n:

drivers/net/wireless/iwlwifi/iwl-rx.c:254: error: 'struct iwl_priv' has no member named '_agn'
drivers/net/wireless/iwlwifi/iwl-rx.c:303: error: 'struct iwl_priv' has no member named '_agn'
drivers/net/wireless/iwlwifi/iwl-rx.c:304: error: 'struct iwl_priv' has no member named '_agn'
drivers/net/wireless/iwlwifi/iwl-rx.c:305: error: 'struct iwl_priv' has no member named '_agn'
drivers/net/wireless/iwlwifi/iwl-rx.c:306: error: 'struct iwl_priv' has no member named '_agn'

and many more.

Conflicts:

drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
drivers/net/wireless/iwlwifi/iwl-debugfs.c
drivers/net/wireless/iwlwifi/iwl-dev.h
drivers/net/wireless/iwlwifi/iwl-rx.c

Reported-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: Remove suspicious register write

Remove suspicious register write as the reg variable is never filled
with an TX_SW_CFG2 associated value before.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: fix use of mcs rates

In case of mcs rates txrate->idx contains the mcs index to be used for
transmission. Previously the mcs values dedicated for legacy rates where
used for mcs transmissions which resulted in the use of mcs 0 in a number
of cases (e.g. for all mcs rates >= 15 as rt2x00 does not register legacy
rates with indexes >= 15).

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Update TX_SW_CFG initvals for 305x SoC

Update TX_SW_CFG initvals for 305x SoC to match with the appropriate
legacy driver.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Use IEEE80211_TX_CTL_STBC flag

Use the IEEE80211_TX_CTL_STBC flag to determine the
correct value to be used for the STBC field in the
TX descriptor

Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: rt2800: disable TX STBC for 1 stream devices

Disable TX STBC for 1 stream devices as a minimum of 2 streams is needed for TX STBC.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Fix HT40 operation in rt2800.

Closer inspection of the legacy Ralink driver reveals that in case of HT40+
or HT40- we must adjust the frequency settings that we program to the device.
Implement the same adjustment in the rt2x00 code.

With this HT40 seems to work for all devices supported by rt2800pci and
rt2800usb.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Sync rt2800 MCU boot signal with Ralink driver.

Latest versions of the Ralink rt2800 family drivers use 0 as the token value,
not 0xff.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Move PCI/USB specific register initializations to rt2800{pci,usb}.

This prevents us having common code depend on PCI or USB specific code.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Simplify check for external LNA in rt2800_init_rfcsr.

Instead of parsing the EEPROM information, use the flag that was set during
device initialization.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Introduce separate interface type for PCI-express.

Needed later for PCI-express specific code in rt2800pci.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Move all register definitions for rt2800 to rt2800.h.

There is no point on having them separated across 3 files.
At the same time rename USB_CYC_CFG to its proper name US_CYC_CNT
(as per the datasheet).

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Remove RT2870 chipset identification.

There is no evidence, either in adapters or in the Ralink code, that such
a device actually exists. All so-call RT2870 adapter identify themselves
as RT2860.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Centralize rt2800 beacon writing.

The beacon writing functions of rt2800pci and rt2800usb are now identical.
Move them to rt2800lib to only have one central function.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Clean up USB vendor request buffer functions.

There is no need to force the separation between a buffer USB vendor
request that does fit the CSR cache and one that doesn't onto the
callers. This is something that the rt2x00usb_vendor_request_buff
function can figure out by itself.
Combine the rt2x00usb_vendor_request_buff and
rt2x00usb_vendor_request_large_buff functions into a single one, as
both of them were equivalent for small buffers anyway.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Fix rt2800usb TX descriptor writing.

The recent changes to skb handling introduced a bug in the rt2800usb
TX descriptor writing whereby the length of the USB packet wasn't
calculated correctly.
Found via code inspection, as the devices themselves didn't seem to mind.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Properly reserve room for descriptors in skbs.

Instead of fiddling with the skb->data pointer and thereby risking
out of bounds accesses, properly reserve the space needed in an
skb for descriptors.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Reverse calling order of bus write_tx_desc and driver write_tx_desc.

For rt2800 reverse the calling order of rt2x00pci_write_data and
rt2800pci_write_data. Currently rt2800pci_write_data calls rt2x00pci_write_data
as there can be only 1 driver callback function specified by the driver.
Reverse this calling order by introducing a new driver callback function,
called write_tx_datadesc, which is called from the bus-specific write_tx_data
functions.
Preparation for futher cleanups in the skb data handling of rt2x00.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

rt2x00: Push beacon TX descriptor writing to drivers.

Not all the devices require a TX descriptor to be written (i.e. rt2800
device don't require them). Push down the creation of the TX descriptor
to the device drivers so that they can decide for themselves whether
a TX descriptor is to be created.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>

ath9k_htc: fix build error when ATH9K_HTC_DEBUGFS not enabled

Signed-off-by: John W. Linville <linville@tuxdriver.com>

wl1271: Fix scan parameter handling for 5GHz

The 5GHz bands were scanned without the proper IE's in place, preventing
proper 5GHz scanning. This patches fixes the problem by storing a pointer
to the scan request (with the IE's) for all iterations of scan.

Signed-off-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Reviewed-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wl1271: Use proper rates for PSM entry/exit null-funcs for 5GHz

A fixed 1 mbps rate was used for the PSM entry/exit null-func frames. Fix this
by using the basic rates instead.

Signed-off-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Reviewed-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wl1271: the core wl1271 module shouldn't depend on SPI_MASTER

The core wl1271 module can also be used with SDIO, so it should not depend on
SPI_MASTER.

Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
Reviewed-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wl1271: Flush TX buffers to air before going to idle

The mac80211 changes to idle almost immediately after transmitting some
frames, such as deauth etc. When going to idle, the wl1271 is disconnected,
which causes TX frames already on buffers, but not yet transmitted, to be
deleted.

To make sure deauth frames reach the air, allow the TX buffers to flush
before proceeding to idle.

Signed-off-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Reviewed-by: Teemu Paasikivi <ext-teemu.3.paasikivi@nokia.com>
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wl1271: Idle handling into own function

As there is more and more stuff triggered by going in and out of idle,
create a separate function for handling that.

Signed-off-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Reviewed-by: Teemu Paasikivi <ext-teemu.3.paasikivi@nokia.com>
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wl1271: Prevent dropping of TX frames in joins

The wl1271 uses a session counter in CMD_JOIN and TX frame descriptors. This
counter is used to determine which frames to drop when the CMD_JOIN is
executed.

The driver executes CMD_JOIN multiple times upon association and sometimes
disassociation, and we don't want any frames to get lost.

Fix this by incrementing the session counter only when leaving idle (not every
CMD_JOIN as before.) Also, remove the TX flush flag from the CMD_JOIN options.

Signed-off-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Reviewed-by: Teemu Paasikivi <ext-teemu.3.paasikivi@nokia.com>
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: cleanup: remove unneeded null check

We dereference "wmi" on the line before and also when we initialize "ah".
This check has always been after a dereference since the first commit a
couple months ago.  Looking through the code, it looks like "wmi" can't
actually be null here so I just removed the check.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/prism54: Use memdup_user

Use memdup_user when user data is immediately copied into the
allocated region.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
position p;
identifier l1,l2;
@@

-  to = \(kmalloc@p\|kzalloc@p\)(size,flag);
+  to = memdup_user(from,size);
   if (
-      to==NULL
+      IS_ERR(to)
                 || ...) {
   <+... when != goto l1;
-  -ENOMEM
+  PTR_ERR(to)
   ...+>
   }
-  if (copy_from_user(to, from, size) != 0) {
-    <+... when != goto l2;
-    -EFAULT
-    ...+>
-  }
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix bug in validating received data length for edma

The rx status length should also be taken into account while
validating the length of a received frame.

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix bug in accessing skb->data of rx frame for edma

Skip the rx status portion in skb->data before accessing ieee80211
frame header.

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Clean up few function parameters in recv.c

ath9k_rx_skb_preprocess() needs only ieee80211 frame header,
pass only frame headers instead of skb to that function. Also
remove ineffective frame dump in ath9k_process_rate().

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Move driver specific structures

A bunch of data structures are present in the
common module, which are internal to ath9k.
Move them to ath9k.h

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Move ath9k specific RX code to driver

This patch relocates RX processing code from the
common module to ath9k. This reduces the size
of the common module which is also used by ath9k_htc.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless: Storage class should be before const qualifier

The C99 specification states in section 6.11.5:

The placement of a storage-class specifier other than at the beginning
of the declaration specifiers in a declaration is an obsolescent
feature.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Acked-by: Reinette Chatre <reinette.chatre@intel.com>
Acked-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_hw: Enable TX IQ calibration on AR9003

To enable it we now disable and re-enable the PHY chips
after TX IQ calibration.

Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

cfg80211: make action channel type optional

When sending action frames, we want to verify
that we do that on the correct channel. However,
checking the channel type in addition can get in
the way, since the channel type could change on
the fly during an association, and it's not
useful to have the channel type anyway since it
has no effect on the transmission. Therefore,
make it optional to specify so that if wanted,
it can still be checked, but is not required.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: print error message if ANI levels are out of range

Since we have sysfs to manually set the ANI levels, we should print errors to
the kernel log if the values are out of bounds.

Signed-off-by: Bruno Randolf <br1@einfach.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: always calculate ANI listen time

Calculate 'listen' time also when automatic ANI is off, since this and the
"busy" time is useful information also in manual mode.

Signed-off-by: Bruno Randolf <br1@einfach.org>
Acked-by: Nick Kossifidis <mickflemm@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: add sysfs files for ANI parameters

/sys/class/ieee80211/phy0/device/ani/ani_mode
/sys/class/ieee80211/phy0/device/ani/noise_immunity_level
/sys/class/ieee80211/phy0/device/ani/spur_level
/sys/class/ieee80211/phy0/device/ani/firstep_level
/sys/class/ieee80211/phy0/device/ani/ofdm_weak_signal_detection
/sys/class/ieee80211/phy0/device/ani/cck_weak_signal_detection
/sys/class/ieee80211/phy0/device/ani/noise_immunity_level_max
/sys/class/ieee80211/phy0/device/ani/spur_level_max
/sys/class/ieee80211/phy0/device/ani/firstep_level_max

sysfs has a lot of symlinks, so you can find the files also in other locations,
like (by PCI ID) /sys/devices/pci0000:00/0000:00:11.0/ani and others.

Signed-off-by: Bruno Randolf <br1@einfach.org>
Acked-by: Nick Kossifidis <mickflemm@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: use ath5k_softc as driver data

It's our "private driver data"... It's used more often and hw is the mac80211
part. This makes more sense with the next (sysfs) patch.

Signed-off-by: Bruno Randolf <br1@einfach.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: clarify logic when to enable spur mitigation filter

The old code logically did not make sense and seems to have been confused by
the fact that we could have newer EEPROMs on older hardware. In any case the
spur mitigation filter was set if the srev was >= AR5K_SREV_AR5424.

Spur info is available only from EEPROM versions bigger than 5.3 but but the
EEPOM routines will use static values for older versions, so that should be
o.k.

Signed-off-by: Bruno Randolf <br1@einfach.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: remove ATH_TRACE macro

Now that we have ftrace, it is not needed any more.

Signed-off-by: Bruno Randolf <br1@einfach.org>
Acked-by: Nick Kossifidis <mickflemm@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: run NF calibration only every 60 seconds

Since NF calibration interferes with TX and RX and also has been the cause of
other problems (when it's run concurrently with ath5k_reset) we want to run it
less often - every 60 seconds for now.

Signed-off-by: Bruno Randolf <br1@einfach.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: Stop queues only for NF calibration

As far as we know, only NF calibration interferes with RX/TX so we can
leave the queues enabled for the other calibrations.

BTW: Stopping the queues is not enough for avoiding transmissions, since there
might be packets in the queue + beacons are also sent regularly! But i leave it
like this until we have a better solution (stopping TX DMA?).

Signed-off-by: Bruno Randolf <br1@einfach.org>
Acked-by: Nick Kossifidis <mickflemm@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: move noise floor calibration into tasklet

Seperate noise floor calibration from other PHY calibration and move it to the
tasklet. This is the first step to more separation of different calibrations.

Also move out ath5k_hw_request_rfgain_probe(ah) so we have one clean function
for I/Q calibration on 5111x parts.

Signed-off-by: Bruno Randolf <br1@einfach.org>
Acked-by: Nick Kossifidis <mickflemm@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: initialize calibration timers

Initialize calibration timers on reset, since otherwise they might be in the
future and the calibration tasklet might not be scheduled for a long time.

Signed-off-by: Bruno Randolf <br1@einfach.org>
Acked-by: Nick Kossifidis <mickflemm@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: increase assocbuf size and validate association info offsets from driver

Buffer size for get_association_info was limited to WEXT event size. Since association
info no longer is sent through WEXT, this limit is not needed. Code also did not
check if data get truncated, memory outside buffer might be addressed. Fix all these.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_hw: Enable auto sleep for ar9003

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix power save with auto sleeping

Rx should not be disabed/disabled when hw supports auto sleeping.

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Make sure null func frame is acked before going into PS for ar9003

Add missing code to handle nullfunc frame completion in
ath_tx_edma_tasklet().

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wireless: fix several minor description typos

Signed-off-by: Walter Goldens <goldenstranger@yahoo.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

cfg80211: don't refuse HT20 channels on devices that don't support HT40

Don't refuse HT20 channels on devices that don't support HT40.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_htc: Enable RX STBC for AR9271

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_htc: Enable SGI in HT20 for AR9271

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_htc: Update HT configuration properly

Use BSS_CHANGED_HT to handle HT parameter changes.
The rate information on the target has to be updated
to handle changes in HT configuration.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_htc: Cleanup rate initialization

This patch removes a large chunk of code dealing
with rate management within the driver and simplifying
things by removing the hacky method of calculating
HT changes. A subsequent patch would fix this by
just using BSS_CHANGED_HT from mac80211.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_htc: Initvals update for AR9271

Update from internal systems engineering team.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/orinoco: Use kmemdup

Use kmemdup when some other buffer is immediately copied into the
allocated region.

A simplified version of the semantic patch that makes this change is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
statement S;
@@

-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
   if (to==NULL || ...) S
-  memcpy(to, from, size);
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/p54: Use kmemdup

Use kmemdup when some other buffer is immediately copied into the
allocated region.

A simplified version of the semantic patch that makes this change is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
statement S;
@@

-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
   if (to==NULL || ...) S
-  memcpy(to, from, size);
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/ipw2x00: Use kmemdup

Use kmemdup when some other buffer is immediately copied into the
allocated region.

A simplified version of the semantic patch that makes this change is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
statement S;
@@

-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
   if (to==NULL || ...) S
-  memcpy(to, from, size);
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Acked-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/b43: Use kmemdup

Use kmemdup when some other buffer is immediately copied into the
allocated region.

A simplified version of the semantic patch that makes this change is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
statement S;
@@

-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
   if (to==NULL || ...) S
-  memcpy(to, from, size);
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/ath/ath9k: Use kmemdup

Use kmemdup when some other buffer is immediately copied into the
allocated region.

A simplified version of the semantic patch that makes this change is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
statement S;
@@

-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
   if (to==NULL || ...) S
-  memcpy(to, from, size);
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/iwmc3200wifi: Use kmemdup

Use kmemdup when some other buffer is immediately copied into the
allocated region.

A simplified version of the semantic patch that makes this change is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
statement S;
@@

-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
   if (to==NULL || ...) S
-  memcpy(to, from, size);
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Acked-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/libertas_tf: Use kmemdup

Use kmemdup when some other buffer is immediately copied into the
allocated region.

A simplified version of the semantic patch that makes this change is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
statement S;
@@

-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
   if (to==NULL || ...) S
-  memcpy(to, from, size);
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/wl12xx: Use kmemdup

Use kmemdup when some other buffer is immediately copied into the
allocated region.

A simplified version of the semantic patch that makes this change is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
statement S;
@@

-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
   if (to==NULL || ...) S
-  memcpy(to, from, size);
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Acked-by: Kalle Valo <kvalo@adurom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/libertas: Use kmemdup

Use kmemdup when some other buffer is immediately copied into the
allocated region.

A simplified version of the semantic patch that makes this change is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
statement S;
@@

-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
   if (to==NULL || ...) S
-  memcpy(to, from, size);
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k/debug: fixup the return codes

Changed -EINVAL to -EFAULT if copy_to_user() failed.
Changed 0 to -ENOMEM if allocations failed.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k/debug: improve the snprintf() handling

The snprintf() function returns the number of bytes that *would* have
been written (not counting the NULL terminator) and that can potentally
be more than the size of the buffer.

In this patch if there were one liners where string clearly fits into
the buffer, then I changed snprintf to sprintf().  It's confusing to use
the return value of snprintf() as a limitter without verifying that it's
smaller than size.  This is what initially caught my attention here.
If we use the return value of sprintf() instead future code auditors will
assume we've verified that it fits already.

Also I did find some places where it made sense to use the return value
after we've verified that it is smaller than the buffer size.

Finally the read_file_rcstat() function added an explicit NULL terminator
before calling snprintf().  That's unnecessary because snprintf() will
add the null terminator automatically.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: fix dma direction for map/unmap in ath_rx_tasklet

For edma, we should use DMA_BIDIRECTIONAL, or else use
DMA_FROM_DEVICE.

Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

libertas: Added callback functions to support SDIO suspend/resume.

In suspend() host sleep is activated using already configured
host sleep parameters through wol command, and in resume() host
sleep is cancelled. Earlier priv->fw_ready flag used to reset and
set in suspend and resume handler respectively. Since after suspend
only host goes into sleep state and firmware is always ready, those
changes in flag state are removed.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wl1271: Add support for NVS files with 5GHz band parameters

This patch adds support for NVS files with 5GHz band parameters. The change
is done in a backward compatible manner - if 11a is not enabled in the driver,
the driver will allow also old NVS files to be loaded.

Signed-off-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Reviewed-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wl1271: Update handling of the NVS file / INI parameters

This patch updates the handling of the NVS file INI-section, trying to make
it slightly more generic, and exposing the parameters being set. This is done
in preparation for 5GHz parameters.

Signed-off-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Reviewed-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_htc: Increase credit size

This is the maximum supported by the firmware.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_htc: Remove HW queue translation

There is no need to determine the HW queue
for each packet that is transmitted. The endpoint
can be chosen directly based on the queue type
that mac80211 sends down.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_htc: Initialize beacon/CAB queues

This patch initializes the beacon and CAB HW queues
when the driver is loaded.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_htc: Add queue statistics to xmit debugfs file

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Enable Short GI in 20 Mhz for ar9287 and later chips

This patch enables short GI rx at all rates and tx at mcs15
for 20 Mhz channel width also.

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/orinoco: Use kzalloc

Use kzalloc rather than the combination of kmalloc and memset.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression x,size,flags;
statement S;
@@

-x = kmalloc(size,flags);
+x = kzalloc(size,flags);
 if (x == NULL) S
-memset(x, 0, size);
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: enable the baseband watchdog events for AR9003

This enables the baseband watchdog events for the AR9003
family on ath9k. Upon an a baseband watchdog interrupt we reset
the hardware, this should address corner case conditions where
normal operation can stall. Enable ATH_DBG_RESET to be able
to review details of the bb watchdog interrupt once it happens.
If you're curious how often this happens just grep the debugfs
interrupt file.

Cc: Sam Ng <sam.ng@atheros.com>
Cc: Paul Shaw <paul.shaw@atheros.com>
Cc: Don Breslin <don.breslin@atheros.com>
Cc: Cliff Holden <cliff.holden@atheros.com
Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_hw: add support for the AR9003 baseband watchdog

The baseband watchdog will monitor blocks of the baseband
through timers and will issue an interrupt when things are
detected to be stalled. It is only available on the AR9003
family.

Cc: Sam Ng <sam.ng@atheros.com>
Cc: Paul Shaw <paul.shaw@atheros.com>
Cc: Don Breslin <don.breslin@atheros.com>
Cc: Cliff Holden <cliff.holden@atheros.com
Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: add the minstrel_ht rate control algorithm

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: Move rt2x00debug_dump_frame declaration to rt2x00.h.

This allows rt2x00debug_dump_frame to be used from everywhere.

This is preparation for beacon writing clean ups.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wl1271: remove sdio ARM dependency

Make it possible to use wl1271's SDIO interface on non-ARM platforms.

Fully tested on a x86 platform, compile-tested on ARM.

Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Acked-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_hw: rename the ar9003_initvals.h to ar9003_2p0_initvals.h

Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_hw: add support for the AR9003 2.2

The checksums of the initvals are:

initvals -f ar9003-2p2
0x00000000c2bfa7d5        ar9300_2p2_radio_postamble
0x00000000ada2b114        ar9300Modes_lowest_ob_db_tx_gain_table_2p2
0x00000000e0bc2c84        ar9300Modes_fast_clock_2p2
0x00000000056eaf74        ar9300_2p2_radio_core
0x0000000000000000        ar9300Common_rx_gain_table_merlin_2p2
0x0000000078658fb5        ar9300_2p2_mac_postamble
0x0000000023235333        ar9300_2p2_soc_postamble
0x0000000054d41904        ar9200_merlin_2p2_radio_core
0x000000008475a084        ar9300_2p2_baseband_postamble
0x000000009aaafd90        ar9300_2p2_baseband_core
0x000000003df9a326        ar9300Modes_high_power_tx_gain_table_2p2
0x000000001cfba124        ar9300Modes_high_ob_db_tx_gain_table_2p2
0x0000000011302700        ar9300Common_rx_gain_table_2p2
0x00000000a9a2b114        ar9300Modes_low_ob_db_tx_gain_table_2p2
0x00000000a9d66d40        ar9300_2p2_mac_core
0x000000001e1d0800        ar9300Common_wo_xlna_rx_gain_table_2p2
0x00000000a0c531c8        ar9300_2p2_soc_preamble
0x00000000292e2544        ar9300PciePhy_pll_on_clkreq_disable_L1_2p2
0x000000002d3e2544        ar9300PciePhy_clkreq_enable_L1_2p2
0x00000000293e2544        ar9300PciePhy_clkreq_disable_L1_2p2

Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwl8k: use the dma state API instead of the pci equivalents

The DMA API is preferred.

No functional change.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Lennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Merge branch 'wireless-next-2.6' of git://git./linux/kernel/git/iwlwifi/iwlwifi-2.6

ssb: fix NULL ptr deref when pcihost_wrapper is used

Ethernet driver b44 does register ssb by it's pcihost_wrapper
and doesn't set ssb_chipcommon. A check on this value
introduced with commit d53cdbb94a52a920d5420ed64d986c3523a56743
and ea2db495f92ad2cf3301623e60cb95b4062bc484 triggers:

BUG: unable to handle kernel NULL pointer dereference at 00000010
IP: [<c1266c36>] ssb_is_sprom_available+0x16/0x30

Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>