rtlwifi: rtl8192cu: Fix false loss of AP indication

A major change in the rtlwifi family recently added code to detect when
there is loss of AP signals. One critical statement needed for the USB
driver was missed.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmsmac: Fix merge issue

Commit 7088f4835aa353f7226e57e73fd9e6564a4dfb75
"Merge branch 'master' of
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless"
ramoved call to brcms_led_unregister in mac80211_if.c

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ssb: implement ssb spuravoid for chipid BCM43222

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Acked-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: Correct pci_unmap_single's size

There exist mismatch between the size used for pci_map and
pci_unmap on command skb. Correcting it.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: Do not kfree cmd buf while unregistering PCIe

All the command buffers are freed in mwifiex_free_cmd_buffer()
and hence there is no need to kfree the current command buffer
again. This might ends up freeing memory allocated by some other
kernel code.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: Call pci_release_region after calling pci_disable_device

"drivers should call pci_release_region() AFTER
calling pci_disable_device()"

Please refer section 3.2 Request MMIO/IOP resources
in Documentation/PCI/pci.txt

Cc: <stable@vger.kernel.org> # 3.2+
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: Use pci_release_region() instead of a pci_release_regions()

PCI regions are associated with the device using
pci_request_region() call. Hence use pci_release_region()
instead of pci_release_regions().

Cc: <stable@vger.kernel.org> # 3.2+
Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Merge branch 'for-john' of git://git./linux/kernel/git/iwlwifi/iwlwifi-next

Merge branch 'for-upstream' of git://git./linux/kernel/git/bluetooth/bluetooth-next

Bluetooth: btmrvl: report error if verify_fw_download times out

FW does the synchronization of the different modules during init.
It will report different modules, that it is ready at different times.
The fw download 'winner' will be reported fw ready first. Without this
patch, btmrvl was already continuing before the FW told it too. Probably
on behalf of the 'winner' which then never sees FW ready and times out.

Signed-off-by: Andreas Fenkart <andreas.fenkart@streamunlimited.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: btmrvl: release lock while waiting for fw download complete

If not winner, driver must release the sdio host lock, so the fw
download can progress. While holding the lock fw download is stalled
and the following error is produced:

[  235.746015] Bluetooth: FW failed to be active in time!
[  235.752799] Bluetooth: Downloading firmware failed!

Signed-off-by: Andreas Fenkart <andreas.fenkart@streamunlimited.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: btmrvl: use native helpers for debugfs

Clean up the code by using native debugfs helpers, instead of implementing
them ourselves:

debugfs_create_u8()
debugfs_create_x16()
debugfs_create_file()
debugfs_remove_recursive()

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: Remove unneeded parameter from L2CAP ATT channel handling

The CID is fixed to L2CAP ATT channel and so there is no need to hand it
down to the handling function. Just use a constant instead.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: hci_get_cmd_complete() can be static

There are new sparse warnings show up in

tree:   git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next master
head:   a0b644b0385fa58ca578f6dce4473e8a8e6f6c38
commit: 75e84b7c522c6e07964cd1f5bf28535768a1e9fa Bluetooth: Add __hci_cmd_sync() helper function
date:   13 days ago

>> net/bluetooth/hci_core.c:82:16: sparse: symbol 'hci_get_cmd_complete' was not declared. Should it be static?

Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: Add support for Intel Bluetooth device [8087:07dc]

This patch adds support for Intel Bluetooth device by adding
btusb_setup_intel() routine that update the device with ROM patch.

T:  Bus=02 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  4 Spd=12   MxCh= 0
D:  Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=8087 ProdID=07dc Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  64 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

Bluetooth: Fix sending write_le_host_supporte for LE-only controllers

The Bluetooth Core Specification (4.0) defines the Write LE Host
Supported HCI command as only available for controllers supporting
BR/EDR. This is further reflected in the Read Local Extended Features
HCI command also not being available for LE-only controllers. In other
words, host-side LE support is implicit for single-mode LE controllers
and doesn't have explicit HCI-level enablement.

This patch ensures that the LE setting is always exposed as enabled
through mgmt and returns a "rejected" response if user space tries to
toggle the setting. The patch also ensures that Write LE Host Supported
is never sent for LE-only controllers.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

mwifiex: rework round robin scheduling of bss nodes.

Rotate bss prio list, so the bss next to the one served, will come first
in the list of bss' with equal priority. This way we pick bss nodes in a
round robin fashion. Using list rotation instead of a cur ptr simplifies
iteration to calling list_for_each_entry. List rotation is done via
list_move, where the head itself is temporarily removed and then
re-inserted after the bss just served.

Signed-off-by: Andreas Fenkart <andreas.fenkart@streamunlimited.com>
Acked-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: replace ra_list_curr by list rotation.

After a packet is successfully transmitted, ra list is rotated, so the ra
next to the one transmitted, will be the first in the list. This way we
pick the ra' in a round robin fashion. This significantly simplifies
iteration in  mwifiex_wmm_get_highest_priolist_ptr to a call to
list_for_each_entry.
List rotation is done via list_move, where the head itself is temporarily
removed and then re-inserted after the item just transferred.

Signed-off-by: Andreas Fenkart <andreas.fenkart@streamunlimited.com>
Acked-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: add credit borrowing mechanism

The firmware provides credits to the driver per WMM-AC. When
only AC_BE are to be transmitted to the firmware the driver
may use credits from other priorities to send AC_BE packets
towards the firmware.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: correct error handling in brcmf_fws_init()

In brcmf_fws_init() the error flows were not properly handled
and the caller ignored the return value. The only action that
is allowed to fail in brcmf_fws_init() is setting the tlv in
firmware as the feature is not supported on all devices.

Cc: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: flush queue upon MACDESC_DEL firmware signal

When firmware signals the driver to remove a destination entry
it may have sk_buff packets queued for it. These should be freed.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: support critical protocol API for DHCP

Adds support for the critical protocol API provided by nl80211
which gives Wifi traffic priority over a Bluetooth (e)SCO connection
and disables scanning during DCHP negotiation.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: allow scanning to be suppressed in the driver

During the DHCP protocol exchange it is benificial to suppress
scan requests which may decrease time to complete DHCP protocol.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix RX DMA mapping

After the commit "ath9k: improve dma map failure handling", the
wrong buffer was DMA-unmapped, introducing warnings like the one below.
This patch fixes the issue.

WARNING: at /home/sujith/dev/wireless-testing/lib/dma-debug.c:986 check_sync+0x4bc/0x580()
Hardware name: LIFEBOOK AH531
ath9k 0000:02:00.0: DMA-API: device driver tries to sync DMA memory it has not allocated [device address=0x00000000d9012800] [size=48 bytes]
Pid: 86, comm: kworker/u:5 Tainted: G        W  O 3.9.0-rc8-wl-debug #106
Call Trace:
 [<ffffffff810410c0>] warn_slowpath_common+0x70/0xa0
 [<ffffffff8104113c>] warn_slowpath_fmt+0x4c/0x50
 [<ffffffff8125432c>] check_sync+0x4bc/0x580
 [<ffffffff8109e5f7>] ? trace_hardirqs_on_caller+0xa7/0x190
 [<ffffffff8109e6ed>] ? trace_hardirqs_on+0xd/0x10
 [<ffffffff81254488>] debug_dma_sync_single_for_device+0x48/0x50
 [<ffffffffa0a53825>] ? ath9k_iowrite32+0x35/0x90 [ath9k]
 [<ffffffff812512f0>] ? swiotlb_tbl_sync_single+0x50/0x90
 [<ffffffff81251350>] ? swiotlb_sync_single+0x20/0x30
 [<ffffffff8125137f>] ? swiotlb_sync_single_for_device+0xf/0x20
 [<ffffffffa0a58baf>] ath_rx_edma_buf_link+0xef/0x140 [ath9k]
 [<ffffffffa0a58c4e>] ath_rx_addbuffer_edma+0x4e/0x90 [ath9k]
 [<ffffffffa0a59c51>] ath_startrecv+0xf1/0x120 [ath9k]
 [<ffffffffa0a550e0>] ath_complete_reset+0x20/0x130 [ath9k]
 [<ffffffffa0a5790d>] ath_reset_internal+0x10d/0x210 [ath9k]
 [<ffffffffa0a5878c>] ath9k_config+0x47c/0x7b0 [ath9k]
 [<ffffffffa06d4978>] ieee80211_hw_config+0x88/0x3f0 [mac80211]
 [<ffffffffa06d4a3f>] ? ieee80211_hw_config+0x14f/0x3f0 [mac80211]
 [<ffffffffa06dbed1>] __ieee80211_scan_completed+0xc1/0x440 [mac80211]
 [<ffffffffa06dd002>] ieee80211_scan_work+0x82/0x440 [mac80211]
 [<ffffffff810606a3>] process_one_work+0x1e3/0x530
 [<ffffffff81060641>] ? process_one_work+0x181/0x530
 [<ffffffff8106163f>] worker_thread+0x10f/0x3c0
 [<ffffffff81061530>] ? manage_workers+0x330/0x330
 [<ffffffff810665da>] kthread+0xea/0xf0
 [<ffffffff810664f0>] ? kthread_create_on_node+0x140/0x140
 [<ffffffff8146085c>] ret_from_fork+0x7c/0xb0
 [<ffffffff810664f0>] ? kthread_create_on_node+0x140/0x140

Cc: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Acked-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Use lockless variants for the RX fifo queue

The RX fifo can be accessed from the common tasklet or it can
be reaped/cleaned when RX is stopped, which is done when doing
a reset or channel change - this happens in process context.

Since it is ensured that there are no pending tasklets when
stopping RX and cleaning the FIFO, there is no need to use
SKB queue functions which take internal locks.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Acked-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Reduce deep indentation

The EDMA case is handled first, so the else condition
can be removed.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Acked-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Remove unused argument "size"

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Acked-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: add support for the new rate control API

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: merge ath_tx_start_dma into ath_tx_start

The split makes no sense and merging the functions makes further changes
easier to implement

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtl8192c:dm: Properly initialize local array and set value.

GCC 4.8 is spitting out uninitialized-variable warnings against
"drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c".  This patch adds
initialization to the variable and properly sets its value.

Signed-off-by: Han Shen (shenhan@google.com)
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: apply coverage class on slottime too

According to 802.11-2007 17.3.8.6 (slot time), the slot time should
be increased by 3 us * coverage class. The code only increased the
ack timeout, which is fixed by this patch.

We have noticed in our long shot scenario that we see less collisions
with this patch.

Signed-off-by: Mathias Kretschmer <mathias.kretschmer@fokus.fraunhofer.de>
[add standard reference and commit message]
Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Merge branch 'master' of git://git.infradead.org/users/rafal/b43-next

Merge branch 'master' of git://git./linux/kernel/git/linville/wireless

Conflicts:
drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c

b43: N-PHY: don't use deprecated b43_radio_foo16

All radio ops are 16b (there is only 1 exception for reg 0x1), so we
deprecated b43_radio_read16 and b43_radio_write16 long time ago.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: N-PHY: clean init tables

Sort defines, use one macro for all revs, support for 5GHz when
uploading antenna table.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: N-PHY: move tables init function to tables file

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: N-PHY: use defines for (re)storing VCM config

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: N-PHY: use shortcut "ctl" in functions names

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: N-PHY: use enum for INTC override function argument

Also make a function name shorter so we can easily fit 80 chars.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: N-PHY: define missing registers

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: use defines for board_type

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: N-PHY: fix "NB" RSSI calibration on PHYs rev2-

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: N-PHY: use enum for RSSI type everywhere we use it

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: N-PHY: rename RSSI types to be shorter and more accurate

Thanks to Broadcom releasing some code we can use better names.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: N-PHY: use more friendly variables names in RSSI code

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: N-PHY: simplify conditions in RSSI offset scale function

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: N-PHY: use enum for RAIL type

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: HT-PHY: use enum for RSSI types

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: HT-PHY: store TX power state before disabling it

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: HT-PHY: define regs for power estimation

In MMIO dumps of ndiswrapper there are following PHY ops:
phy_read(0x0118) -> 0x013d
phy_read(0x01ed) -> 0x993d
phy_read(0x0119) -> 0x012f
phy_read(0x01ee) -> 0x992f
phy_read(0x011a) -> 0x0139
phy_read(0x0969) -> 0x9939
It matches the code of wlc_phy_txpower_est_power_nphy (from brcm80211),
so we know the registers meaning.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: HT-PHY: do some extra TSSI setup after configuring TX

After b43_phy_ht_tx_power_ctl_setup there are some extra radio ops:
 radio_read(0x08bf) -> 0x0001
radio_write(0x08bf) <- 0x0001
radio_write(0x0159) <- 0x0011
On N-PHY we write 0x11 to TSSI regs, so it's probably sth similar.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: HT-PHY: finish calculating values for idle TSSI

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: HT-PHY: tables: don't duplicate core-generic regs

Now when we know many radio regs at 0x000 are core-generic, I've noticed
we duplicate some values in the tables.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

b43: HT-PHY: rename defines addressing cores on the 2059 radio

After comparing writes to registers at 0x000, 0x400 and 0x800 it seems
there are many very similar writes. So 0x000 offset is not for accessing
something totally different, but probably just the first out of three
cores.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

mwifiex: remove redundant initialization for bss_descriptor

Initialization of bss_descriptor is unnecessary as the entire
structure will be overwritten by a memcpy followed by.

Initialize disable_11ac flag properly by setting it to true in
mwifiex_fill_new_bss_desc().

Reported-by: Doug Anderson <dianders@chromium.org>
Reviewed-by: Doug Anderson <dianders@chromium.org>
Reviewed-by: Paul Stewart <pstew@chromium.org>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: fix use-after-free in beacon_ie processing

beacon_ie buffer is allocated in mwifiex_fill_new_bss_desc()
and the buffer pointer is saved in bss_desc->beacon_buf.
beacon_ie is freed before the function returns. However,
bss_desc->beacon_buf is still being accessed afterwards.

Fix it by freeing beacon_ie (bss_desc->beacon_buf) in
caller's scope.

Reviewed-by: Doug Anderson <dianders@chromium.org>
Reviewed-by: Paul Stewart <pstew@chromium.org>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: don't try to associate when bss_mode is not STA

We have blocked association attempts on interfaces configured in
AP and AD-HOC modes. P2P mode should be blocked too.

Furthermore, an error code must be returned if we are unable to
associate.

Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: make use of msecs_to_jiffies()

Use msecs_to_jiffies() wherever possible.

Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: correct bss_mode check while appending vht operation IE

priv->bss_mode uses NL80211_IFTYPE_* definitions.
HostCmd_BSS_MODE_IBSS is used in ad-hoc start/join command between
driver and firmware.

Coincidentally both HostCmd_BSS_MODE_IBSS and NL80211_IFTYPE_STATION
are defined as 2. That explains why nobody complained.

Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: use PCI_DMA_FROMDEVICE for RX queue de-init

There is a typo in mwifiex_cleanup_rxq_ring() which uses
PCI_DMA_TODEVICE while unmapping PCI memory.
We should actually use PCI_DMA_FROMDEVICE.

Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: configure p2p interface during initialization

Send P2P_MODE_CFG cmd to firmware when p2p interface is created.
Without proper p2p configuration firmware may behave incorrectly
while handling commands sent through this interface.

Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: Stone Piao <piaoyun@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwifiex: Start P2P devices in P2P mode

p2p devices should identify themselves as such to userspace at
startup, so the connection manager can decide which interface
to start wpa_supplicant instances on.

Signed-off-by: Paul Stewart <pstew@chromium.org>
Reviewed-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: Use more current logging styles, shrink object size

Reduce object space ~2% using more current logging styles.

Neaten and simplify logging macros.
Use wiphy_<level> where appropriate.
Coalesce formats.

Convert ERROR/WARNING/INFO macros to rt2x00_<level>
Convert EEPROM to rt2x00_eeprom_dbg
Convert PROBE_ERROR to rt2x00_probe_err
Convert DEBUG to rt2x00_dbg
Convert EEPROM to rt2x00_eeprom_dbg

$ size drivers/net/wireless/rt2x00/built-in.o*
   text    data     bss     dec     hex filename
 245639   71696   69584  386919   5e767 drivers/net/wireless/rt2x00/built-in.o.new
 240609   70096   68944  379649   5cb01 drivers/net/wireless/rt2x00/built-in.o.new.nodyndbg
 240609   70096   68944  379649   5cb01 drivers/net/wireless/rt2x00/built-in.o.new.no_rt2x00_debug
 249198   70096   70352  389646   5f20e drivers/net/wireless/rt2x00/built-in.o.old
 249198   70096   70352  389646   5f20e drivers/net/wireless/rt2x00/built-in.o.old.nodyndbg
 244222   70096   69712  384030   5dc1e drivers/net/wireless/rt2x00/built-in.o.old.no_rt2x00_debug

Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: rt2800lib: rename rt2800_init_bbb_early to rt2800_init_bbp_early

The function is used for BBP register initialization,
fix the typo in the function name to reflect that.

The patch contains no functional changes.

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: fix potential NULL pointer dereference in brcmf_fws_flow_control_check()

The dereference to 'ifp' in debug code should be moved below the NULL test.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: more Rx descriptor accessor functions

Helpers to fetch various fields from the Rx descriptor

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: Use cached copy of Tx descriptor

Original Tx descriptor stored is in non-cached area for DMA;
copy it to the cached memory to speed-up access

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: Tx init optimization

vring size is known from the beginning, fill it immediately
in the struct initializer
This is minor optimization that reduces code size.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

wil6210: Use cached copy of Rx descriptor

Rx descriptors stored in non-cacheable memory area for DMA.
Non-cacheable memory causes long access time from CPU.

Copy rx descriptor to the skb->cb, and use this copy.
It provides faster memory access, and will be usefull to keep
Rx information for later processing (BACK reorder)

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: stop dequeue upon sk_buff commit failure

In the dequeue worker the function brcmf_commit_skb() is called.
However, instead of increment the credit count upon success it
should break the for loop upon failure. Otherwise, it will result
in an endless loop.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: change return type for brcmf_rollback_toq() to void

The function brcmf_rollback_toq() is already called in error path
and its result should not override the initial error value. As the
function releases the sk_buff there is no need to return anything
so change return type to void.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: finalize transmit upon any rollback failure

All rollback failures should result in freeing of the sk_buff
by calling brcmf_txfinalize().

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: use lock in brcmf_fws_del_interface()

When deleting an interface in firmware-signalling module it will
clear any destination descriptors. To avoid concurrency issues it
should take the lock using brcmf_fws_lock().

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: schedule dequeue upon firmware-signal reception

Several firmware signals should be considered as opportunity to
send packets to the firmware. This patch adds conditional scheduling
of the dequeue worker thread while handling those signals.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: destination mac closed when interface is closed

Firmware signals a destination is closed as well as an interface. A
destination is associated with an interface. When an interface is
closed consequently the destination should be considered closed as
well.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmutil: simplify brcmu_pkt_free_skb()

The function brcmu_pkt_free_skb() use skb->destructor to decide
how the sk_buff should be freed. However, when running AP mode
with iptables configured this results in a kernel warning.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: remove error message upon allocation failure

In function brcmf_add_if() an error message is printed
upon alloc_netdev() failure. The allocation failure itself
spews enough info in the log so remove the error message.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: check memory allocation in brcmf_add_if()

For P2P_DEVICE interface the struct brcmf_if instance is
allocated using kzalloc() which can fail. Add pointer
check and return -ENOMEM if it failed. Fixes the following
smatch error:

"drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c:770
brcmf_add_if()
  error: potential null dereference 'ifp'. (kzalloc returns null)"

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

brcmfmac: reinitialize dequeue mask per node

The mask was only initialized for the first node, but it should be
done for each node that is handled in the loop.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2800: nulify all last words of TXWI

Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: provide separate information about TXWI & RXWI sizes

On new 2800 hardware sizes of TXWI & RXIW can be different than TXD
& RXD sizes, so we need to difference between them. Let's define
winfo_size as size of in buffer descriptor (TXWI & RXWI), and desc_size
of as size of additional descriptor - in separate DMA coherent buffer
for PCI hardware (TXD & RXD) and yet another in buffer descriptor for
USB hardware (TXINFO & RXINFO).

Change is rt2x00 wild, but should affect only 2800 driver.

Patch also fix beaconing for 5592usb AP mode.

Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2800: cleanup rt2800_init_rfcsr

This procedure is simple switch now and return no error any longer.

Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2800: add rt2800_normal_mode_setup_3xxx subroutine

Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2800: add rt2800_led_open_drain_enable subroutine

Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2800: move RF_R27 setup to individual rfcsr init subroutines

Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2800: add rt2800_rx_filter_calibration procedure

Add procedure for both bands filter calibration and use it on individual
chipset init rfcsr subroutines.

Remove "Set back to initial state" code for 3290 since vendor driver
DPO_RT3290_LinuxSTA_V2600_20120508 does not include it.

Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2800: move RFCSR6_R2 & LDO_CFG0 setup to 3572 specific rfcsr init

Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2800: move GPIO_SWITCH setup to 3390 specific rfcsr init

Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2800: move 30xx common rf init code

Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2800: move RFCSR29_RSSI_GAIN to 3290 specific rfcsr init

Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2800: move rf init calibration code

Add separate function for rf init calibration code and use it
on all init rf subroutines.

Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2800: merge 5xxx normal mode setup

Merge code which program the same registes at the end of rfcsr
initialization for 5592, 5392 and 5390 chips.

Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: always set common->macaddr to the MAC adress of a virtual interface

In some cases it can be useful to change the MAC address of a virtual
interface to something that's completely different from the EEPROM
stored MAC address. In this case it is a bad idea to use the EEPROM MAC
address for calculating the BSSID mask, as that would make it too wide.

In one case a few devices have been observed to send ACKs for many
packets on the channel not directed at them, which results in a neat
Denial of Service attack on the channel.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath: update hardware mac address with bssid mask

Preparation for updating common->macaddr along with virtual interface
MAC address changes.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: use GFP_ATOMIC under spinlock

This is called with spinlocks held so we have to use GFP_ATOMIC.  It's
the sc_pcu_lock in ath9k_stop() that's the issue.  The call tree looks
like this:

ath9k_stop()
ath_prepare_reset()
ath_stoprecv()
ath_flushrecv()
ath_rx_tasklet()
ath9k_dfs_process_phyerr()
pd->add_pulse() => dpd_add_pulse()
channel_detector_get()
channel_detector_create()
pri_detector_init()

channel_detector_create() uses GFP_ATOMIC as well.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Tested-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
Acked-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: change DFS logging to use ath_dbg()

The DFS pattern detector was initially planned to reside on
a higher layer and used generic pr_*() logging functions.

Being part of ath9k, use ath_dbg() instead and make DFS log
ouput selectable via ATH_DBG_DFS (0x20000) at runtime.

This patch does not contain functional modifications.

Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: Fix transmit power troubles on some Ralink RT30xx cards

Some cards on Ralink RT30xx chipset not have correctly TX_MIXER_GAIN
value in them EEPROM/EFUSE. In this case, we must use default value,
but always used EEPROM/EFUSE value. As result we have tranmitt power
range from -10dBm to +6dBm instead 0dBm to +16dBm.

Correctly value in EEPROM/EFUSE is one or more for RT3070 and two or
more for other RT30xx chips.

Tested on Canyon CNP-WF518N1 usb Wi-Fi dongle and Jorjin WN8020 usb
embedded Wi-Fi module.

Signed-off-by: Alex A. Mihaylov <minimumlaw@rambler.ru>
Cc: stable@vger.kernel.org
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwl8k: remove nonstandard rate 72 Mbps

This rate causes an overflow in the extended rates IE's data rate field,
with the overflowing bit setting the Basic Rate Set membership. This
results in a bogus 8 Mpbs basic rate, making clients checking them refuse
association.

Since the rate is likely unused anyway (HT will yield better rates between
supporting chips), we can just remove it.

This fixes association from wpa_supplicant and Android 4.x and newer.

Signed-off-by: Jonas Gorski <jogo@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Merge branch 'for-john' of git://git./linux/kernel/git/jberg/mac80211-next

Merge branch 'for-upstream' of git://git./linux/kernel/git/bluetooth/bluetooth-next