The GFP_DMA flag is obviously misunderstood in the mwifiex driver. It's
meant for legacy ISA DMA memory mappings only -- the lower 16MB on x86.
That doesn't apply to PCIe or SDIO devices, I guess.

Remove the GFP_DMA flag to reduce the need to place the socket buffer
allocation into the low mem DMA area, which might already be in use by
other drivers.

This misuse was flagged by the PaX USERCOPY feature by chance, as it
detected the user copy operation from a DMA buffer in the recvfrom()
syscall path.
Signed-off-by: NMathias Krause <minipli@googlemail.com>
Tested-by: NDennis Wassenberg <dennis.wassenberg@secunet.com>
Cc: Amitkumar Karwar <akarwar@marvell.com>
Cc: Nishant Sarmukadam <nishants@marvell.com>
Cc: Xinming Hu <huxm@marvell.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: Brad Spengler <spender@grsecurity.net>
Cc: PaX Team <pageexec@freemail.hu>
Acked-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The action 'check for winner' and 'download firmware' should be an
atomic action. This is true for btmrvl driver but not mwmfiex, which
cause firmware download to fail when the following senerio happens:

1) mwifiex check winner status: true
2) btmrvl check winner status: true, and start downloading firmware
3) mwfieix tries to download firmware, but failed because btmrvl is
already downloading.

This won't happen if 1) and 3) is an atomic action. This patch adds
sdio_claim/release_host call around those two actions to make sure it's
atomic.
Signed-off-by: NWei-Ning Huang <wnhuang@chromium.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Do not dereference card before checking against NULL value.
Signed-off-by: NHeinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Variable adapter is incorrectly initialized.

Fixes: bf00dc22 ("mwifiex: AMSDU Rx frame handling in AP mode")
Signed-off-by: NHeinrich Schuchardt <xypron.glpk@gmx.de>
Acked-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

firmare -> firmware
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Use dev_err instead of pr_err and add newline character at the end.
Signed-off-by: NWei-Ning Huang <wnhuang@chromium.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This header file is only needed for drivers binding to a PCI bridge
device allocated by drivers/pci/pcie/portdrv_core.c. The mwifiex driver
doesn't do that nor use any symbols defined in pcieport_if.h.

Cc: Amitkumar Karwar <akarwar@marvell.com>
Cc: Nishant Sarmukadam <nishants@marvell.com>
Signed-off-by: NLukas Wunner <lukas@wunner.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Sometimes current polling count is not sufficient.
This patch increases it to 100.
Signed-off-by: NShengzhen Li <szli@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Replace all trans_start updates with netif_trans_update helper.
change was done via spatch:

struct net_device *d;
@@
- d->trans_start = jiffies
+ netif_trans_update(d)

Compile tested only.

Cc: user-mode-linux-devel@lists.sourceforge.net
Cc: linux-xtensa@linux-xtensa.org
Cc: linux1394-devel@lists.sourceforge.net
Cc: linux-rdma@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: MPT-FusionLinux.pdl@broadcom.com
Cc: linux-scsi@vger.kernel.org
Cc: linux-can@vger.kernel.org
Cc: linux-parisc@vger.kernel.org
Cc: linux-omap@vger.kernel.org
Cc: linux-hams@vger.kernel.org
Cc: linux-usb@vger.kernel.org
Cc: linux-wireless@vger.kernel.org
Cc: linux-s390@vger.kernel.org
Cc: devel@driverdev.osuosl.org
Cc: b.a.t.m.a.n@lists.open-mesh.org
Cc: linux-bluetooth@vger.kernel.org
Signed-off-by: NFlorian Westphal <fw@strlen.de>
Acked-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
Acked-by: NMugunthan V N <mugunthanvnm@ti.com>
Acked-by: NAntonio Quartulli <a@unstable.cc>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

It's been observed that sometimes AP's probe response is
received after scan duration gets completed for the channel.
This happens especially when wildcard scan is performed
along with specific SSID scan.
We will increase the time from 30 msecs to 40 msecs.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

As 2.4Ghz channels are overlapping, sometimes AP responds to
probe request even if it's operating on neighbouring channel.
Currently firmware drops those scan entries, as current channel
doesn't match with APs channel.

This patch enables MWIFIEX_DISABLE_CHAN_FILT flag in scan
command to disable the feature so that better scan results
will be received in 2.4Ghz band.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In cfg80211 resume handler, we query wakeup reason from firmware and
report to cfg80211. if wowlan is disabled, connection is already
terminated during suspend. We don't need to query wakeup reason in this
case.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

It's been observed that wakeup on GTK rekey failure wasn't reported
to cfg80211. This patch corrects the check so that all valid wakeup
reasons are reported.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Redundant space in case statement is removed.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

tx_packets counter is incremented for aggregated packets, when it had
already been incremented for the aggregated packet's constituent
parts. Removing the extra count.
Signed-off-by: NMarty Faltesek <mfaltesek@google.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Signed-off-by: NMarty Faltesek <mfaltesek@google.com>
Reviewed-by: NJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

When a packet is queued from the bridge, wmm_tx_pending is not
incremented, but when the packet is dequeued the counter is decremented.
Signed-off-by: NMarty Faltesek <mfaltesek@google.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

USB8XXX_FW_MAX_RETRY is 3.  We were using a post-op loop
"while (retries--) {" but then the lines after that assume the loop
exits with retries set to zero.

I've fixed this by changing to a pre-op loop.  I started with retries
set to 4 instead of 3 so that we still go through the loop the same
number of times.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

We accidentally return success instead of -ENOMEM.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Transmit data path should not touch background scan. We will stop
background scan when net device is closed.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

On some arm-based platforms, we need to configure platform specific
parameters by device tree node and also define our node as a child
node of parent SDIO host controller.
This patch parses these parameters from device tree. It includes
calibration data dowoload to firmware, wakeup pin configured to firmware,
and soc specific wake up gpio, which will be set as wakeup interrupt pin.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

after factoring out mwifiex_cancel_pending_scan_cmd
the function is not called outside of cmdevt file
moved function to head of file to avoid forward declaration,
also moved mwifiex_recycle_cmd_node since they are very similar
Signed-off-by: NAndreas Fenkart <afenkart@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Releasing the scan_pending lock in mwifiex_check_next_scan_command
introduces a short window where pending scan commands can be removed
or added before removing them all in mwifiex_cancel_pending_scan_cmd.
I think this is safe, since the worst thing to happen is that a
pending scan cmd is removed by the command handler. Adding new scan
commands is not possible while one is pending, see scan_processing flag.
Since all commands are removed from the queue anyway, we don't care if
some commands are removed by a different code path earlier, the final
state remains the same.
I assume, that the critical section needed for the check has been
extended over clearing the pending scan queue out of convenience. The
lock was already held and releasing it and grab it again was just
more work. It doesn't seem to be necessary because of concurrency.
Signed-off-by: NAndreas Fenkart <afenkart@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

improves readability
Reviewed-by: NJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: NAndreas Fenkart <afenkart@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

merge copy/paste code
Signed-off-by: NAndreas Fenkart <afenkart@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

"x ? x : y" can be simplified as "x ? : y"
https://gcc.gnu.org/onlinedocs/gcc/Conditionals.html#ConditionalsReviewed-by: NJulian Calaby <julian.calaby@gmail.com>
Signed-off-by: NAndreas Fenkart <afenkart@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Signed-off-by: NAndreas Fenkart <afenkart@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

given this structure:
struct foo {
  struct bar {
     int baz;
  }
}

these accesses are equivalent:
(*(foo->bar)).baz
foo->bar->baz
Signed-off-by: NAndreas Fenkart <afenkart@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

During system suspend, there is a kernel WARNING issued if there
is a pending command present. By marking the wait queue disabled
after calling the command completion routine fixes it.
Signed-off-by: NVishal Thanki <vishalthanki@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

IEEE80211_CHAN_NO_HT40PLUS and IEEE80211_CHAN_NO_HT40PLUS channel
flags tell if HT40 operation is allowed on a channel or not.

This patch ensures ht_capability information is modified
accordingly so that we don't end up creating a HT40 connection
when it's not allowed for current regulatory domain.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NCathy Luo <cluo@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Host hang is observed if card is removed before firmware download
gets completed. In this case, firmware will be failed to download and
adapter structure gets freed.

In other thread, mwifiex_remove_card() waits on semaphore until the
firmware download fails. This wait is not necessary and may result in
invalid adapter access.

This patch uses down_trylock to return immediately so that hang issue
won't occur.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This patch adds default setting for pcie firmware download name in
case that there are newer chipset version.
Signed-off-by: NShengzhen Li <szli@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This patch adds support for downloading usb/uart firmware for
8997 chipset by reading the chip version.
Signed-off-by: NShengzhen Li <szli@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This patch adds missing break statement at the end of
PCIE_DEVICE_ID_MARVELL_88W8897 switch section.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This enum is already perfectly aliased to enum nl80211_band, and
the only reason for it is that we get IEEE80211_NUM_BANDS out of
it. There's no really good reason to not declare the number of
bands in nl80211 though, so do that and remove the cfg80211 one.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

This patch prints pcie scratch registers during firmware dump. They
will be useful for analysing firmware status.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This patch processes sub AMSDU frame received in AP mode.

If a packet is multicast/broadcast, it is sent to kernel/upper
layer as well as queued back to AP TX queue so that it can be
sent to other associated stations.

If a packet is unicast and RA is present in associated station list,
it is again requeued into AP TX queue.

If a packet is unicast and RA is not in associated station list,
packet is forwarded to kernel to handle routing logic.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NCathy Luo <cluo@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Bridge packets are enqueued to wmm tx queue, but will not be sent
until main workqeue is scheduled for new interrupt or other
reason. This adds unnecessary delay during traffic.

We will schedule main workqueue when bridge packet is queued.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

skb forwarded to TCP/IP stack doesn't need to allocate in DMA ZONE.
This patch removes GFP_DMA flag in this case to save precious DMA
memory.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Some of the chipsets have two revisions. This patch
selects appropriate firmware by checking revision id.
Signed-off-by: NShengzhen Li <szli@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>