The last_phy_res[100] variable is used in an odd
way. The first byte of it is used as a flag, and
the rest as the data. Thus, the array need only
be 61 bytes, since it is just the flag and a
struct iwl_rx_phy_res (which is 60 bytes).

Clean this up by splitting the variable into two:
last_phy_res and last_phy_res_valid, using correct
types for both (struct and bool). While doing all
this also move the variables to the _agn part of
the hw-specific union since they only apply to
A-MPDUs.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>

lq->sta_id cannot be invalid here since this
function will only be called after the station
has been added properly.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>

Simplify the WEP group key check by checking the
sta pointer instead of the sta_id we calculate
with it; also clean up the comment formatting.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>

Default WEP keys and regular keys are not allocated
from the same space in the firmware, so we shouldn't
use the same bits to indicate in use.

For default WEP keys, however, mac80211 won't allow
using the same key index twice, so the check is not
necessary at all -- add/remove are perfectly nested
due to those checks.

Other keys are allocated in the device in a global
array that only has a certain number of slots, so
for that we need to keep the allocation bitmap; but
the 802.11 key index isn't relevant there.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>

The firmware clears default WEP keys on
transitions to !associated, so we need
to restore them just like stations. This
is rather implicit as part of sending a
station right now, which is odd. Make it
explicit instead and only for agn since
3945 doesn't use hw crypto for WEP.

Due to that, iwl_send_static_wepkey_cmd
is now only used in iwl-sta.c and can be
static.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>

Size of event log is determined by uCode which is different per NICs.
Set the maximum event log size per device to better match uCode
configuration.
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>

Resolution of a merge conflict upstream accidentally removed a hunk of
"ath5k: IQ calibration for AR5211 is slightly different", so restore it.
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Simple pre-scan and scan complete callbacks, this at least shows
to me that mac80211 will issue two scans at the same time on the
same wiphy.
Signed-off-by: NLuis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

We check the bounds on pdadc once when correcting for
negative curves but not when we later copy values from
from the pdadc_tmp array, leading to a potential overrun.

Although we shouldn't hit this case in practice, let's
be consistent.
Reported-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NBob Copeland <me@bobcopeland.com>
Acked-by: NBruno Randolf <br1@einfach.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

As pointed out by Benoit Papillault, there is a potential
race condition between the host and the hardware in reading
the next link in the transmit descriptor list:

cpu0              hw
                  tx for buf completed
                  raise tx_ok interrupt
process buf
buf->ds_link = 0
                  read buf->ds_link

This change checks txdp before processing a descriptor
(if there are any subsequent descriptors) to see if
hardware moved on.  We'll then process this descriptor on
the next tasklet.
Signed-off-by: NBob Copeland <me@bobcopeland.com>
Acked-by: NBruno Randolf <br1@einfach.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Review spotted a couple of strange invocations to
ieee80211_wake_queues that could potentially cause problems:

 - queues are awakened in the calibration tasklet before
   phy calibration, and then again after calibration

 - queues are awakened inside reset when we're trying to
   drain the ath5k transmit queues, and again after
   reset is completed (in callers to ath5k_reset_wake).

In both cases the first wake is unnecessary, so remove it.
Signed-off-by: NBob Copeland <me@bobcopeland.com>
Acked-by: NBruno Randolf <br1@einfach.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

These channels aren't selectable anyway, but our calculations
for 2.5 mhz frequencies are incorrect.  The value is supposed to
be:

  (frequency - reference) * (10/25)

i.e., divide by 2.5, but we were instead doing:

  (10 * frequency - reference) / 25.

Additionally, the check for (frequency % 5 == 2) had an extra
subtraction that wasn't in madwifi HAL.
Signed-off-by: NBob Copeland <me@bobcopeland.com>
Acked-by: NBruno Randolf <br1@einfach.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Enhance tracing by adding tracing for a variety of
callbacks that the drivers call, and also for
internal calls (currently limited to queue status).
This can aid debugging what is going on in mac80211
in interaction with drivers, since we can now see
what drivers call and not just what mac80211 calls
in the driver.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

rt2872 needs the same rf register setup as rt3070 and rt3090, hence
use rt2800_config_channel_rt3x instead of rt2800_config_channel_rt2x.
This change allows me to actually switch channels and hence scan all
configured channels on the RT305x SoC platform (which uses a rt2872)
here.
Signed-off-by: NHelmut Schaa <helmut.schaa@googlemail.com>
Acked-by: NGertjan van Wingerde <gwingerde@gmail.com>
Acked-by: NIvo van Doorn <IvDoorn@gmail.com>
Tested-by: NLuis Correia <luis.f.correia@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Don't modify ah->iniModes, it's supposed to be constant.  Instead, apply
the fixup when the data is written to the registers.

Change ath9k_hw_init_eeprom_fix() to only determine whether the fixup is
needed.

This allows similteneous support for AR9220 cards that need AR_AN_TOP2
fixup (such as Ubiquiti SR71-12) and those that don't need it (D-Link
DWA-552 rev A2).
Signed-off-by: NPavel Roskin <proski@gnu.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Messages that are generated by the HTC layer
don't have any TX callback endpoints assigned to them.
Consequently, the allocated SKBs are never freed.

Fix this issue by handling this case in the HTC layer
itself.
Signed-off-by: NSujith <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

hif_usb_regout_cb() frees the given URB, which is
borked by design. Use an anchor to simplify URB
management.
Signed-off-by: NSujith <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The maximum number of packets in a single buffer in
stream mode is 10. The driver currently uses 8 - which
caused stack corruption, in the absence of any kind
of OOB checking.

Fixing this to the correct value of 10 fixes the module
unload issue.
Signed-off-by: NSujith <Sujith.Manoharan@atheros.com>
Tested-by: NMing Lei <tom.leiming@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

RX URBs are automatically freed when the reference
count drops to zero - this currently doesn't happen when
usb_kill_anchored_urbs() is called during unload.

Fix this by dropping the reference count by one during
initial submission.
Signed-off-by: NSujith <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Use a spin lock to prevent concurrent access
to variables dealing with RX stream mode handling.
Currently, no protection is implemented - which
causes problems in RX.
Signed-off-by: NSujith <Sujith.Manoharan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Now that the powersave issues on rt2500usb have been tackled, powersave
can be enabled by default again.
Signed-off-by: NGertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Grouped mesh action codes together with the other action codes in
ieee80211.h.
Signed-off-by: NJavier Cardona <javier@cozybit.com>
Reviewed-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NFrans Pop <elendil@planet.nl>
Cc: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into merge

Conflicts:
	Documentation/feature-removal-schedule.txt
	drivers/net/wireless/ath/ath5k/phy.c
	drivers/net/wireless/iwlwifi/iwl-4965.c
	drivers/net/wireless/iwlwifi/iwl-agn.c
	drivers/net/wireless/iwlwifi/iwl-core.c
	drivers/net/wireless/iwlwifi/iwl-core.h
	drivers/net/wireless/iwlwifi/iwl-tx.c

WEP crypto was broken, but upon finding the problem
it is evident that other things were broken by the
paged RX patch as well.

To fix it, for now move the linearising in front.
This means that we linearise all frames, which is
not at all what we want, but at least it fixes the
problem for now.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Acked-by: NZhu Yi <yi.zhu@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

A few places in mac80211 do not currently acquire
the sta lock for RX aggregation, but they should.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The aggregation code has a number of quirks, like
inventing an unneeded WLAN_BACK_TIMER value and
leaking memory under certain circumstances during
station destruction. Fix these issues by using
the regular aggregation session teardown code and
blocking new aggregation sessions, all before the
station is really destructed.

As a side effect, this gets rid of the long code
block to destroy aggregation safely.

Additionally, rename tid_state_rx which can only
have the values IDLE and OPERATIONAL to
tid_active_rx to make it easier to understand
that there is no bitwise stuff going on on the
RX side -- the TX side remains because it needs
to keep track of the driver and peer states.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

I want to use it during station destruction as well
so rename it to WLAN_STA_BLOCK_BA which is also the
only use of it now.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

All callers of ieee80211_sta_stop_rx_ba_session can
just call __ieee80211_stop_rx_ba_session instead
because they already have the station struct, so do
that and remove ieee80211_sta_stop_rx_ba_session.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

All other places except one in the TX path, which
has BHs disabled, and it also cannot be locked from
interrupts so disabling IRQs is not necessary.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When a station w/o a key is destroyed, or when
a driver submits work for a station and thereby
references it again, it seems like potentially
we could reference the station structure while
it is being destroyed.

Wait for an RCU grace period to elapse before
finishing destroying the station after we have
removed the station from the driver and from
the hash table etc., even in the case where no
key is associated with the station.

Also, there's no point in deleting the plink
timer here since it'll be properly deleted just
a bit later.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NVivek Natarajan <vnatarajan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NVivek Natarajan <vnatarajan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch adds support for a modified newer version of AR9285
chipsets.
Signed-off-by: NVivek Natarajan <vnatarajan@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

cfg80211 is quite strict on allowing authentication and association
commands only in certain states. In order to meet these requirements,
user space applications may need to clear authentication or
association state in some cases. Currently, this can be done with
deauth/disassoc command, but that ends up sending out Deauthentication
or Disassociation frame unnecessarily. Add a new nl80211 attribute to
allow this sending of the frame be skipped, but with all other
deauth/disassoc operations being completed.

Similar state change is also needed for IEEE 802.11r FT protocol in
the FT-over-DS case which does not use Authentication frame exchange
in a transition to another BSS. For this to work with cfg80211, an
authentication entry needs to be created for the target BSS without
sending out an Authentication frame. The nl80211 authentication
command can be used for this purpose, too, with the new attribute to
indicate that the command is only for changing local state. This
enables wpa_supplicant to complete FT-over-DS transition successfully.
Signed-off-by: NJouni Malinen <j@w1.fi>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Better use the macro for consistency, the content is the same anyway.
Signed-off-by: NKalle Valo <kvalo@adurom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This is an Adaptive Noise Imunity (ANI) implementation for ath5k. I have looked
at both ath9k and HAL sources (they are nearly the same), and even though i
have implemented some things differently, the basic algorithm is practically
the same, for now. I hope that this can serve as a clean start to improve the
algorithm later.

This also adds a possibility to manually control ANI settings, right now only
thru a debugfs file:
  * set lowest sensitivity (=highest noise immunity):
	echo sens-low > /sys/kernel/debug/ath5k/phy0/ani
  * set highest sensitivity (=lowest noise immunity):
	echo sens-high > /sys/kernel/debug/ath5k/phy0/ani
  * automatically control immunity (default):
	echo ani-on > /sys/kernel/debug/ath5k/phy0/ani
  * to see the parameters in use and watch them change:
	cat /sys/kernel/debug/ath5k/phy0/ani

Manually setting sensitivity will turn the automatic control off. You can also
control each of the five immunity parameters (noise immunity, spur immunity,
firstep, ofdm weak signal detection, cck weak signal detection) manually thru
the debugfs file.

This is tested on AR5414 and nearly doubles the thruput in a noisy 2GHz band.
Signed-off-by: NBruno Randolf <br1@einfach.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Reported-by: NMyhailo Danylenko <isbear@ukrpost.net>
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch modifies tx-queue flushing to correspond with tx-path - i.e.
also frames for which no ack was requested are forwarded to the mac80211
for disposal.
Signed-off-by: NJuuso Oikarinen <juuso.oikarinen@nokia.com>
Reviewed-by: NLuciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: NLuciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Remove ERROR print from psm-entry-fail scenario, instead use an INFO print.
Also, add INFO print to the beacon-loss scenario.
Signed-off-by: NJuuso Oikarinen <juuso.oikarinen@nokia.com>
Reviewed-by: NTeemu Paasikivi <ext-teemu.3.paasikivi@nokia.com>
Signed-off-by: NLuciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>