The valid range of IO capabilities for the Set IO Capability and Pair
Device mgmt commands is 0-4 (4 being the KeyboarDisplay capability for
SMP). We should return an invalid parameters error if user space gives
us a value outside of this range.
Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Fixed a coding style issue. Removed trailing whitespaces in
drivers/bluetooth/Kconfig.
Signed-off-by: NStephan Gabert <stephan.gabert@fau.de>
Signed-off-by: NNicolas Pfeiffer <nicolas.pfeiffer@fau.de>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Since the SMP code needs to swap ordering of variable length buffers add
a convenience function that can be used for any length buffer.
Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

There's no reason to have explicit values for these flags. Convert them
to an enum to be consistent with other similar flags.
Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

These defines were probably put in to track authenticated vs
unauthenticated LTKs, however since the LTK struct has a separate
boolean authenticated member these were never used.
Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

The LTK type has really nothing to do with HCI so it makes more sense to
have these in smp.h than hci.h. This patch moves the defines to smp.h
and removes the HCI_ prefix in the same go.
Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

We never store the "master" type of STKs since we request encryption
directly with them so we only need one STK type (the one that's
looked-up on the slave side). Simply remove the unnecessary define and
rename the _SLAVE one to the shorter form.
Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

The smp_chan_create function may return NULL, e.g. in the case of memory
allocation failure, so we always need to check for this.
Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Since the whole HCI command, event and data packet processing has been
migrated to use workqueues instead of tasklets, it makes sense to use
struct delayed_work instead of struct timer_list for the timeout
handling. This patch converts the hdev->cmd_timer to use workqueue
as well.
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>

When allocating the L2CAP SKB for transmission, provide the upper layers
with a clear distinction on what is the header and what is the body
portion of the SKB.
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>

The struct l2cap_ctrl fields are wasting an unsigned int when all the
bits can fit into an __u8 field.
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>

The SKB for L2CAP sockets are all allocated in a central callback
in the socket support. Instead of having to pass around the socket
priority all the time, assign it to skb->priority when actually
allocating the SKB.
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>

The struct l2cap_ops field should not allow any modifications and thus
it is better declared as const.
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>

Invoking usb_sndbulkpipe() on same pipe for same purpose only once is
enough.
Signed-off-by: NAdam Lee <adam8157@gmail.com>
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>

This adds some cores with 0x2057 radio which will be supported soon as
well as core 40 that I missed in the earlier firmware patch.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

It doesn't include any device (radio revision) specific code yet, so it
isn't really usable. As the commit says, it's just some generic code.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Enable initialization and update calibration code to fix:
b43-phy0 ERROR: Radio 0x2057 rcal timeout
b43-phy0 debug: Radio 0x2057 rccal timeout
b43-phy0 debug: Radio 0x2057 rccal timeout
b43-phy0 ERROR: Radio 0x2057 rcal timeout
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

There are several exit path from the PCI probe function.
Some of them, that are taken in case of errors, forget to set the "err"
variable, that is returned by the probe function.
This can lead to the kernel thinking the probe function succeeds while it
didn't, and this in turn causes extra calls to the "remove" function.

This patch fix this problem by ensuring "err" variable is assigned to a proper
non-zero value in each exit path.
Signed-off-by: NAndrea Merello <andrea.merello@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

All boards supported by this driver could work using PIO or MMIO for accessing
registers.
This driver tries to access HW by using MMIO, and, if this fails for somewhat
reason, the driver tries to fall back to PIO mode.

MMIO-mode is straightforward on all boards.
PIO-mode is straightforward on rtl8180 only.

On rtl8185 and rtl8187se boards not all registers are directly available in PIO
mode (they are paged).

On rtl8185 there are two pages and it is known how to switch page.
PIO mode works, except for only one access to a register out of default page,
recently added by me in the initialization code with patch:
rtl818x_pci: Fix rtl8185 excessive IFS after CTS-to-self
This can be easily fixed to work in both cases (MMIO and PIO).

On rtl8187se, for a number of reasons, there is much more work to do to fix PIO
access.
PIO access is currently broken on rtl8187se, and it never worked.

This patch fixes the said register write for rtl8185 and makes the driver to
fail cleanly if PIO mode is attempted with rtl8187se boards.

While doing this, I converted also a couple of printk(KERN_ERR) to dev_err(), in
order to make checkpatch happy.
Signed-off-by: NAndrea Merello <andrea.merello@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Currently the driver configures mac80211 to provide two rates for each TX frame:
One initial rate and one alternate fallback rate, each one with its retry count.

HW does not support fully this: rtl8180 doesn't have support for rate scaling at
all, and rtl8185/rtl8187SE supports it in a way that does not fit with mac80211:
The HW does automatically fall back to the next lower rate, and only a lower
limit can be specified, so the HW may TX also on rates in between the two rates
specified by mac80211.  Furthermore only the total TX retry count can be
specified for each packet, while the number of TX attempts before scaling rate
can be configured only globally (not per each packet).

Currently the driver sets the HW auto rate fallback mechanism to quickly scale
rate after a couple of retries, and it uses the alternate rate requested by
mac80211 as fallback limit rate (and it does this even wrongly).

The HW indeed will behave differently than what mac80211 mandates, that is
probably undesirable, and the reported TX retry count may not refer to what
mac80211 thinks, and this could fool mac80211.

This patch makes the driver to declare to mac80211 to support only one rate
configuration for each packet, and it does disable the HW auto rate fallback
mechanism, relying only on SW and letting mac80211 to do all by itself.

This should ensure correct operation and fairness respect to mac80211.
Indeed here tests with iperf do not show significant performance differences.
Signed-off-by: NAndrea Merello <andrea.merello@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

HW is programmed with wrong retry count value for TX:

Mac80211 passes to driver the number of times the TX should be attempted.
The HW, instead, wants the number of time the TX should be retried if it fails
the first time (assuming we have to TX it at least one time).

This patch correct this.
Signed-off-by: NAndrea Merello <andrea.merello@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Rtl8187se support has been added to the rtl818x_pci driver by extracting a lot
of information from a rtl8187se Linux staging driver included in the kernel at
the time rtl8187se support was added.
The rtl818x_pci main file has a comment that advertises this.

Recently this staging driver has been removed from the kernel, but I still feel
it can be useful as "reference" code (in case of bugs, or to implement
improvements in rtl818x_pci driver).

This one-line patch adds a comment in rtl818x_pci driver to point people
searching for that "reference code" to the last kernel version still containing
it (3.14).
Signed-off-by: NAndrea Merello <andrea.merello@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Measuring time between _end_ of CTS-to-self and _end_ of datapacket (with a
prism54 board and mac80211 hacked to let the MAC timestamp stay untouched in the
radiotap header) resulted in about 300uS, while the datapacket itself should be
by far shorter (less than 100uS) and IFS should be SIFS (10uS).
This measure was confirmed whith a scope: about 250uS IFS has been seen between
the two packets.

This situation causes the CTS-to-self protection mechanism to work incorrectly
due to the NAV expiring during, or even before beginning, the packet
transmission, and it also causes the performances to be anyway reduced due to
time waste.

This problem has been seen at every packet TXed with CTS-to-self enabled on
rtl8185 board.
rtl8187se seems not affected (and rtl8180, being a 802.11b card, does not have
CTS-to-self mechaninsm).

This patch fixes this by adding a magic register write, making the board wait
for correct SIFS after CTS-to-self packet.
Signed-off-by: NAndrea Merello <andrea.merello@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

BSSID register was written with six byte-writes.
It seems that, similarly to what happens with MAC registers, they needs to be
written with one 16-bit and one 32-bit writes, otherwise the write does not work.

The byte write didn't work only on my rtl8185, while it worked on rtl8180 and
rtl8187se, BTW since there are probably a number of different ASIC revisions out
of there, I let the change to affect all cards.
It shouldn't hurt anyway.
Signed-off-by: NAndrea Merello <andrea.merello@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

LCNXN is simply a continuation of N, e.g. code handling LCNXN revs 0 and
1 is mostly the same as for N-PHY revs 7+.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Fix checkpatch warning:
WARNING: kfree(NULL) is safe this check is probably not required

Cc: Stanislav Yakovlev <stas.yakovlev@gmail.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Cc: linux-wireless@vger.kernel.org
Signed-off-by: NFabian Frederick <fabf@skynet.be>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The patch fixes a couple of issues:
- absence of deallocation of rsi_dev->rx_usb_urb[0] in the driver;
- potential NULL pointer dereference because of lack of checks for memory
  allocation success in rsi_init_usb_interface().

By the way, it makes rsi_probe() returning error code instead of 1
and fixes comments regarding returning values.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Right now sleep duration is configured as beacon interval. It should be
the multiple of beacon interval by listen period which helps to
reduce station power consumption.
Signed-off-by: NRajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Earlier the listen interval is used to decide switching between
operating and off-channels during bgscan and to improve throughput,
the listen interval is reduced to 1. After optimiztion in scan
state machine, listen period is not used for decision making and
hence reverting it back to original value.
Signed-off-by: NRajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The beacon configurations are not cached properly after the station
associates with AP. Not handling BEACON_INFO, is failing to update
dtim period and also it is causing below warning message.

WARNING: CPU: 1 PID: 0 at drivers/net/wireless/ath/ath9k/recv.c:548
ath_rx_tasklet+0xc89/0xca0 [ath9k]()
 Call Trace:
  [<c14669c9>] dump_stack+0x48/0x69
  [<c104f1a2>] warn_slowpath_common+0x82/0xa0
  [<fd38c2f9>] ? ath_rx_tasklet+0xc89/0xca0 [ath9k]
  [<fd38c2f9>] ? ath_rx_tasklet+0xc89/0xca0 [ath9k]
Signed-off-by: NRajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Treat frames that underwent a CCK or OFDM restart as frames with an invalid CRC.
Signed-off-by: NMathy Vanhoef <vanhoefm@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When the FIF_FCSFAIL filter flag is set, pass frames with CRC errors.
Signed-off-by: NMathy Vanhoef <vanhoefm@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Why is converting time formats so desired if there are proper
interfaces for this?
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Acked-by: NBing Zhao <bzhao@marvell.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Cc: linux-wireless@vger.kernel.org
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This reverts commit a82fc3b4a2bceb7c6587249cb690342eb5065979.

Thomas corrected me on that I misunderstood Johannes' comment
for net_timedelta() and the ktime_get_real() usage inside
__net_timestamp().

Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: John W. Linville <linville@tuxdriver.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

CC: "Rafał Miłecki" <zajec5@gmail.com>
CC: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: NFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Fixed a warning related to incorrect return type and removed an
unnecessary semi colon.
Signed-off-by: NJahnavi Meher <jahnavi.meher@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Fixed a potential buffer overflow in 'rsi_rates' and a sparse warning
related to difference in endianness in rsi_91x_mgmt.c.
Signed-off-by: NJahnavi Meher <jahnavi.meher@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The p54 driver uses request_firmware() twice, once for actual
firmware and then another time for an optional user overide on
EEPROM, 3826.eeprom. The custom EEPROM  is optional but if not
present we'll introduce an extra lag of 60 seconds with udev
present. Annotate we don't want udev nonsense here to avoid
the lag in case its not present.

This was found with the following SmPL patch.

@ firmware_not_critical @
expression cf;
expression config_file;
expression dev;
int ret;
identifier l;
statement S;
@@

-	ret = request_firmware(&cf, config_file, dev);
+	ret = request_firmware_direct(&cf, config_file, dev);
	if (ret < 0) {
		... when != goto l;
		    when != return ret;
		    when any
	} else {
		...
		release_firmware(cf);
		...
	}

Cc: Takashi Iwai <tiwai@suse.de>
Cc: Christian Lamparter <chunkeey@googlemail.com>
Cc: linux-wireless@vger.kernel.org
Cc: cocci@systeme.lip6.fr
Signed-off-by: NLuis R. Rodriguez <mcgrof@suse.com>
Acked-By: NChristian Lamparter <chunkeey@googlemail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>