The firmware channel specification is a bitfield using a
16-bit integer, but only 14 lsb are used. Upon encoding
this value assure all 16 bits are cleared.
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The function brcmf_fw_nvram_strip() is no longer called so
it does not need to be exposed.
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch adds use of asynchronous firmware request to
the driver USB layer.
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch adds use of asynchronous firmware request to
the driver SDIO layer.
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The driver needs firmware to be loaded to the device, which
is done through the firmware class API. The synchronous call
request_firmware() need root filesystem to be mounted and/or
user-mode helper. These may not be avaliable on the moment
it is called. Instead use request_firmware_nowait().
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NFranky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Reviewed-by: NArend Van Spriel <arend@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NHante Meuleman <meuleman@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The resume callbacks do partly the same a the probe callback
so put common code in separate function for use in the callbacks.
This also fixes suspend/resume regression introduced by

    brcmfmac: remove .init() callback for internal bus interface

    The .init() callback was the first function called by the common
    bus function brcmf_bus_start(). Given that it is not really
    necessary and the bus layer can call it before calling the
    brcmf_bus_start() function.
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The function brcmf_detach() checks whether it needs to do his stuff
or can return immediately. No need to have the same check in the
calling code.
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The firmware processing will be modified to use asynchronous request
firmware api. In preparation this patch is simple rename of source
and header file to which the functionality will be added.
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The .init() callback was the first function called by the common
bus function brcmf_bus_start(). Given that it is not really
necessary and the bus layer can call it before calling the
brcmf_bus_start() function.
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: NFranky Lin <frankyl@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The function chandef_to_chanspec() was added by

    brcmfmac: determine chanspec from struct cfg80211_chan_def info

    The struct cfg80211_chan_def contains additional info to derive the
    bandwidth and side-band information of the chanspec. This patch adds
    chandef_to_chanspec() function used in IBSS join and starting AP
    operation.

However, it introduced a sparse warning because the function
is only called from within the source file wl_cfg80211.c.
Reported-by: NFengguang Wu <fengguang.wu@intel.com>
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Before informing cfg80211 about the scan status the device should
be put back in mpc state. If done after user-space may initiate
another (scheduled) scan and fail because scan is still busy as
shown in logging below:

[ 3301.367376] brcmfmac: brcmf_fweh_event_worker event ESCAN_RESULT (69)
[ 3301.377305] brcmfmac: brcmf_fweh_event_worker   version 2 flags 0 status 0
[ 3301.384993] brcmutil: event payload, len=12
[ 3301.389208] 00000000: 0c 00 00 00 6d 00 00 00 34 12 00 00
[ 3301.389214] brcmfmac: brcmf_sdio_kso_control Enter: on=0
[ 3301.402196] brcmfmac: brcmf_inform_bss scanned AP count (0)
[ 3301.407808] brcmfmac: brcmf_notify_escan_complete Enter
[ 3301.413064] brcmfmac: brcmf_notify_escan_complete ESCAN Completed scan: Done
[ 3301.420137] brcmfmac: brcmf_sdio_bus_txctl Enter
[ 3301.420368] brcmfmac: brcmf_cfg80211_sched_scan_start Enter
[ 3301.420370] brcmfmac: brcmf_cfg80211_sched_scan_start:
				Scanning already: status (1)
[ 3301.440190] brcmfmac: brcmf_sdio_kso_control Enter: on=1
[ 3301.448695] brcmfmac: brcmf_sdio_tx_ctrlframe Enter
[ 3301.453662] brcmfmac: brcmf_sdio_bus_rxctl Enter
[ 3301.458326] brcmfmac: brcmf_sdio_isr Enter
[ 3301.462523] brcmfmac: brcmf_sdio_dpc Enter
[ 3301.466632] brcmfmac: brcmf_sdio_readframes Enter
[ 3301.471431] brcmfmac: brcmf_sdio_read_control Enter
[ 3301.476340] brcmfmac: brcmf_set_mpc MPC : 1
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When a regular scan does not return any networks user-space does
request a scheduled scan without any matchset or ssid. This can
not be handled by the firmware so we return -EINVAL. However, as
this request is done let us not add an error message to the log.
Reviewed-by: NHante Meuleman <meuleman@broadcom.com>
Reviewed-by: NDaniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: NPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This issue was reported by coccicheck using the semantic patch
at scripts/coccinelle/api/memdup.cocci
Signed-off-by: NBenoit Taine <benoit.taine@lip6.fr>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

To be future-proof and for better readability the time comparisons are
modified to use time_after() instead of plain, error-prone math.
Signed-off-by: NManuel Schölling <manuel.schoelling@gmx.de>
Acked-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Currently the driver uses HW encryption.
Whenever mac80211 calls the set_key() callback the driver restarts the
whole HW configuration procedure, in order to set (also) the new
WEP key.
However, by doing this, it causes the card to loose association information,
and the HW becomes unable to communicate with the BSS.

This patch adds support for sending another HW command, that sets only
the wep key, instead of resetting all.
Mac80211 key-set requests are thus handled via this new command.

Tested on my at76c503
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Loading the driver with DMA debugging enabled makes the kernel to complain
about the ehci driver trying to perform DMA from memory from the stack.

[ 9848.229514] WARNING: CPU: 1 PID: 627 at lib/dma-debug.c:1153 check_for_stack+0xa4/0xf0()
[ 9848.237678] ehci-pci 0000:00:04.1: DMA-API: device driver maps memory fromstack [addr=ffff88006c80da01]

This is due to at76c50x-usb driver passing buffers allocated on the stack to
the USB layer, that attempts DMA. This occurs is several places.

This patch fixes the problem by allocating those buffers via kmalloc.

Since this adds some kfree() before leaving a couple of functions, I caught the
occasion to clean-up the exit path on error.
Signed-off-by: NAndrea Merello <andrea.merello@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The commit "ath9k: fix possible hang on flush" changed the receive code
to always link rx descriptors of processed frames, even when flushing.
In some cases, this leads to flushed rx buffers being passed to the
hardware while rx is already stopped.
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Make DFS pulse interval calculation independent
from CONFIG_ATH9K_DEBUGFS.
Signed-off-by: NZefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Since the rsi_create_kthread interface does not include any format
string arguments, make sure that the resulting thread name can never
accidentally process the name as a format string.
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Fixes the following warning:

  CC      drivers/net/wireless/mwifiex/tdls.o
drivers/net/wireless/mwifiex/tdls.c: In function ‘mwifiex_prep_tdls_encap_data’:
drivers/net/wireless/mwifiex/tdls.c:475:4: warning: passing argument 2 of ‘mwifiex_tdls_add_ht_oper’ discards ‘const’ qualifier from pointer target type [enabled by
default]
    ret = mwifiex_tdls_add_ht_oper(priv, peer, 1, skb);
    ^
drivers/net/wireless/mwifiex/tdls.c:190:1: note: expected ‘u8 *’ but argument is of type ‘const u8 *’
 mwifiex_tdls_add_ht_oper(struct mwifiex_private *priv, u8 *mac,
 ^
drivers/net/wireless/mwifiex/tdls.c:481:4: warning: passing argument 2 of ‘mwifiex_tdls_add_ht_oper’ discards ‘const’ qualifier from pointer target type [enabled by
default]
    ret = mwifiex_tdls_add_ht_oper(priv, peer, 0, skb);
    ^
drivers/net/wireless/mwifiex/tdls.c:190:1: note: expected ‘u8 *’ but argument is of type ‘const u8 *’
 mwifiex_tdls_add_ht_oper(struct mwifiex_private *priv, u8 *mac,
 ^
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

On idle state, sleep timer is scheduled to put the chip into fullsleep.
But during suspend, this timer is scheduled after the chip is moved to
fullsleep forcibily. This is causing below unnecessary error messages
in kernel log during suspend.

ath: phy2: timeout (100000 us) on reg 0x806c: 0xdeadbeef & 0x01f00000
!= 0x00000000
ath: phy2: RX failed to go idle in 10 ms RXSM=0xdeadbeef
ath: phy2: DMA failed to stop in 10 ms AR_CR=0xdeadbeef AR_DIAG_SW=0xdeadbeef
DMADBG_7=0xdeadbeef
Reported-by: NArkh4mKn1ght <arkh4mkn1ght@gmail.com>
Signed-off-by: NRajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The keycache index is used to abort transmission for given station
when it goes to sleep state. But the commit "ath9k_hw: Abort transmission
for sleeping station" is not handling multi-key station. Fix that.

Cc: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: NRajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch adds handling of updating rx sequence number for
packets received from TDLS peer. Current implementation of
mwifiex_queueing_ra_based assumes station would always receive
packets from AP which is not true in case of TDLS.
Fix this by adding this case.
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch fixes an issue where AMSDU packets for TDLS link
would flow over infra link. This happened because we were
missing setting TDLS flag in TxPD on AMSDU packets.
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

If userspace application does not take care of TDLS teardown
event, TDLS link would be present in driver database and thus
driver would send such packets on direct link while peer has
already severed link causing data traffic failure. Disable TDLS
link upon teardown event so as to ensure this does not happen.
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

If TDLS link delete command fails because of non-existent peer
or TDLS peer is absent from driver's entry, it means link was
already deleted. In such case print debug messages with lower
severity.
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In station role if TDLS is supported, we traverse TDLS peer list
to see if packet's destination address matches with TDLS peer.
Packets destined to AP are not sent over TDLS link and hence
avoid this list traversal for such packets.
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

DFS pulse interval printing is only available
when CONFIG_ATH9K_DEBUGFS is set.
Signed-off-by: NZefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Broadcom hardware uses a bit tricky hw_value-s for 5 GHz channels,
values 184-228 are used for 4920-5140 MHz center frequencies. Normally
you expect channels 7-16 (e.g. 5060 MHz is channel 12, not 212). We never
meant to register hw_value 228 with freq 6140 MHz (5000 + 228 * 5).
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Nothing actually uses the return value yet, but we might as well
make it correct, like process_rxed_802_11_packet() does for the
same case.  Also ensure that if monitor mode is enabled (and
thus process_rxed_802_11_packet() is called) that the debugging
enter/leave functions are balanced.
Signed-off-by: NDan Williams <dcbw@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

I've met an endless (or at least very long) loop if I power down the usb
port on witch a usb wifi key is plugged.
(Ok, it's not very smart to power down a usb port when a usb key is in
used... but still, I think that should not lead to an endless loop).

I have a lot of:
ieee80211 phy1: rt2x00usb_vendor_request: Error - Vendor Request 0x07 failed for offset 0x0438 with error -71

(-71==-EPROTO)

How to reproduce:
- plug an usb wifi key
- ip link set wlan0 up
- hub-ctrl -b usb_bus -d usb_device -P usb_port -p 0

hub-ctrl source: https://github.com/codazoda/hub-ctrl.c/blob/master/hub-ctrl.c

The following patch prevents the endless loop, but I'm really not sure
that The Right Way To Do It (R)
Signed-off-by: NRichard Genoud <richard.genoud@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

carl9170_usb_probe() does not handle request_firmware_nowait() failure
that leads to several leaks in this case.
The patch adds all required deallocations.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The power update function looks at all current vifs to determine the power
policy. It doesn't use the current vif. Instead the value was overwritten
and used internally.
Signed-off-by: NArik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

This was not used is unlikely to be used, just kill it.
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

I forgot to disable the reduced Tx power in a few paths.
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>

In some cases, we need to force the association to be off in the
MAC_CONTEXT_CMD command we send to the firmware.  Instead of having to
hack the vif->bss_conf.assoc value, pass it all the way down the call
chain.

Additionally, for the iwl_mvm_mac_ctxt_add() case, we *always* set
forced_assoc_off to true, so we can remove the hack in the d3 code
that was forcing it to off by hacking the bss_conf.assoc value.
Signed-off-by: NLuciano Coelho <luciano.coelho@intel.com>
Reviewed-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>