At some places, ie length is truncated from u16 to u8 while
storing it to driver's internal variable. This patch fixes
the problem.
Signed-off-by: Nchunfan chen <jeffc@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Device fails to connect to some AP's configured in WPA
security mode. Currently IE buffer parsing logic in driver
expects WPA IE to be present at the beginning of IE buffer.
Otherwise connection is failed with 'incompatible network
setting' error.

This patch fixes the problem by improving IE buffer parsing
logic.
Signed-off-by: Nchunfan chen <jeffc@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

If device has already received country information from
EEPROM, we won't parse AP's country IE and download it to
firmware. We will also set regulatory flags to disable beacon
hints and ignore country IE.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NCathy Luo <cluo@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

We already know that "wep_key->key_length" is set so there is no need to
check again.  Also the last curly brace was indented too far.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Part of reorganising wireless drivers directory and Kconfig.
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

600f5d90("mwifiex: cleanup ioctl wait queue and abstraction layer")
introduced the wakeup_interruptible suppression in mwifiex_complete_cmd
b1a47aa5("mwifiex: fix system hang issue in cmd timeout error case")
then added wakup_interruptible to mwifiex_cmd_timeout_func the single
place setting a status of ETIMEDOUT.
Instead of doing extra work, using the standard call-chain will have the
same effect:
mwifiex_cancel_pending_ioctl
-> mwifiex_recycle_cmd_node
-> mwifiex_insert_cmd_to_free_q
-> mwifiex_complete_cmd
-> wake_up_interruptible

The difference is that previously the condition was not set to true,
but that's probably just an oversight in b1a47aa5 and shouldn't
have any consequence
Signed-off-by: NAndreas Fenkart <afenkart@gmail.com>
Acked-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This patch changes all debug print functions from dev_dbg/dev_err/dev_info
to mwifiex specific debug functions.
Signed-off-by: NZhaoyang Liu <liuzy@marvell.com>
Signed-off-by: NCathy Luo <cluo@marvell.com>
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

wait_event_interruptible_timeout() returns 0 upon timeout. We should
convert it to a negative error code (such as -ETIMEDOUT) instead of
returning it directly, as return code of 0 indicates that command was
executed.
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Currently, we support virtual interface type change from
station<=>adhoc or station <=> p2p client/GO.
This patch adds support to change virtual interface type to
any of the type advertised in interface combinations.
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NCathy Luo <cluo@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

FW initialization routine can also be called while changing
virtual interface types.
This patch adds bool parameter "init" to init command routine
so as to differentiate between initialization during driver load
and change virtual interface handler.
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NCathy Luo <cluo@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

wdev is used even after del_virtual_interface handler in cfg80211
in nl80211_post_doit. Since we have freed wdev in handling of
del_virtual_intf, this can result into crash while deleting
interface.
Avoid this be not declaring wdev which part of
mwifiex_private structure but struct wireless_dev type.
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NCathy Luo <cluo@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This patch fixes memory corruption reported by community developer.

"Memory corruption occurs in mwifiex_ret_802_11_key_material_v1()
when a short command response is received without a key length
causing non initialised memory to be interpreted as the key
length resulting in a memcpy() overwriting the part of the
driver's private data structure beyond the key area."

For v1 key material API firmwares, there is no need to send
command to delete WEP key. WEP encryption/decryption is controlled
by mac_control command.

This patch avoids sending key material command in del_key case.
Reported-by: NMartin Fuzzey <mfuzzey@parkeon.com>
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NCathy Luo <cluo@marvell.com>
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

It's been observed that wrong firmware version (ex. 66.14.96.p9
instead of 14.66.9.p96) is displayed on big endian platforms.

The problem is fixed here.
Reported-by: NDaniel Mosquera <daniel.mosquera@ctag.com>
Tested-by: NDaniel Mosquera <daniel.mosquera@ctag.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When assocaiting to an AP , mwifiex set supported data rates
based on target AP's capability. For 5G AP(11a mode), a/n/ac mode
would possibly be set.
However, for some chips which dont support 11AC mode current config_bands
will be used instead.

For example, if we join an IBSS in 11b mode ,adapter->config_bands
will be set to 1(11b mode). Then we leave IBSS ,and try to connect
5G a/n mode AP. At this time , only 11b mode data rates will be
supported in assoc request , which result in assoc failure with
reason code 18: Association denied due to requesting station not
supporting all rates.

This patch fix such a cornel case, by adding additional check for
current chip's 11ac capability.
Reported-by: NAndreas Fenkart <afenkart@gmail.com>
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NMarc Yang <yangyang@marvell.com>
Signed-off-by: NCathy Luo <cluo@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

We will remove 'fw' prefix from these variable and macro
names and make them generic.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NCathy Luo <cluo@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In managed mode if the driver is getting a re-associate command
from cfg80211, driver deauthenticates with the AP internally and
sends a disconnected event to cfg80211 before completion of its
association process. The disconnected event then modifies the
SSID length as wdev->ssid_len = 0. So, upon receiving the connect
result event from driver, cfg80211 is unable to get that BSS from
the device's BSS list and generates the following WARN_ON message.

WARNING: CPU: 0 PID: 857 at net/wireless/sme.c:658
         __cfg80211_connect_result+0x3a6/0x3e0 [cfg80211]()

Avoid re-association while the device is already associated to a
network. Also remove the internal deauthentication from the
association path.
Signed-off-by: NUjjal Roy <royujjal@gmail.com>
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch updates mwifiex Copyright to 2014.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Some SDIO controllers do not support MMC_PM_KEEP_POWER properly.
To test host sleep feature without putting the system into sleep
we need to simulate host sleep configuration & handshake between
driver and firmware using customized parameters.
This patch adds hscfg debugfs item, with which user could change
host sleep parameters for debugging.
Signed-off-by: NXinming Hu <huxm@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

For users who do not need wowlan, load mwifiex.ko with
disconnect_on_suspend = 1; or iw phy0 wowlan disable.
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Sometimes when command timeout occurs due to a firmware or
hardware bug, there may be some synchronous commands in command
queue. These commands are never downloaded to firmware causing
hung task warnings. This patch replaces wait_event_interruptible
call with wait_event_interruptible_timeout to fix the issue.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

It has been observed that system hangs during suspend, if host
sleep activation fails due to a missing interrupt from firmware.
Use timeout variant, so that the thread will be woken up when
timer expires.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When a thread is interrupted by signal, all
wait_event_interruptible calls after queueing commands return
an error. Numbers of commands in pending queue are increased
in this case. Sometimes all commands nodes in pool are filled.

We will cancel pending commands when signal is received.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Sometimes we may end up downloading other commands when host
sleep is configured. This patch makes sure that pending
commands are cancelled and we stop queueing further commands
during host sleep.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

There is a race condition while queuing synchronous command and
asynchronous command requested from different threads, because
the wait_q_enabled flag is set based on a global variable
cmd_wait_q_required.

The issue is fixed by removing this global variable and using a
unified function with an argument 'sync' passed into the
function.
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch adds key material V2 support to mwifiex.
Newer FW supports this feature and FW KEY API version is used
to determine which command structure needs to be used.
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

bit12 in fw_cap_info is for testing only.
Remove all related code.
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This required liberally sprinkling 'const' over brcmfmac
and mwifiex but seems like a useful thing to do since the
pointer can't really be written.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Instead of having two copies of the code for device tree cfgdata
downloading, add a function to improve the code.
Reviewed-by: NPaul Stewart <pstew@chromium.org>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When driver gets regulatory domain change notifications or before
associates to an AP with Country IE, the txpwrlimit table stored
in device tree for that country is downloaded to firmware.

The txpwrlimit downloading will happen only at the first time
when the alpha2 country code is changed. World regulatory domain
"00" notification doesn't trigger the downloading. This behavior
is same as domain_info command.
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

On cfg80211 regulatory domain change, drivers gets alpha2 country
code or "00" in driver's notification handler.

In most cases, the pattern will be US, 00, US, 00, US, 00, US, ...
There is no need to send domain info to firmware in case of "00" or
with the same alpha2 country code.
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

For IBSS join if the requested SSID matches current SSID,
it returns without freeing the allocated beacon IE buffer.

Cc: <stable@vger.kernel.org> # 3.10+
Signed-off-by: NUjjal Roy <royujjal@gmail.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

__le16 to u16 conversion is missing for "pg_tlv_hdr->length"
in mwifiex_get_power_level(). This creates a problem on big
endian machines.
It is resolved by changing definition of the structure
and making required endianness changes.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

We missed bss_mode check for P2P client.
Signed-off-by: NStone Piao <piaoyun@marvell.com>
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch is bug fix for an invalid boundry check for WPS IE.
We should check max IE length against defined macro; instead we were
checking it against size of pointer. Fix it.
Also move IE length check before allocation of memory.
Signed-off-by: NAvinash Patil <patila@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

After receiving channel switch announcement from AP, scan and
association on that channel is blocked for DFS_CHAN_MOVE_TIME
(10 seconds). Hence station will be able to connect to the AP,
once it is moved to new channel.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NPaul Stewart <pstew@chromium.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch adds code to parse requested AP's 11h capabilities
and add 11h information in association request.

Also, deauth is sent to the AP after receiving channel switch
announcement event from firmware. This happens when AP advertises
WLAN_EID_CHANNEL_SWITCH IE in it's beacon.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NPaul Stewart <pstew@chromium.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Use negative check (if(!bss_desc)) and return failure
instead of failing a NULL check later in
mwifiex_check_network_compatibility() routine.
Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When trying to unset a previously-set multicast list (i.e. the new list
has 0 entries), mwifiex_set_multicast_list() was calling down to
mwifiex_request_set_multicast_list() while leaving
mcast_list.num_multicast_addr as an uninitialized value.

We were arriving at mwifiex_cmd_mac_multicast_adr() which would then
proceed to do an often huge memcpy of
mcast_list.num_multicast_addr*ETH_ALEN bytes, causing memory corruption
and hard to debug crashes.

Fix this by setting mcast_list.num_multicast_addr to 0 when no multicast
list is provided. Similarly, fix up the logic in
mwifiex_request_set_multicast_list() to unset the multicast list that
was previously sent to the hardware in such cases.
Signed-off-by: NDaniel Drake <dsd@laptop.org>
Acked-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

A small bug in this code was causing the ALLMULTI filter to be set
when in fact we were just wanting to program a selective multicast list
to the hardware.

Fix that bug and remove a redundant if condition in the code that
follows.

This fixes wakeup behaviour when multicast WOL is enabled. Previously,
all multicast packets would wake up the system. Now, only those that the
host intended to receive trigger wakeups.
Signed-off-by: NDaniel Drake <dsd@laptop.org>
Cc: <stable@vger.kernel.org>
Acked-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Initialization of bss_descriptor is unnecessary as the entire
structure will be overwritten by a memcpy followed by.

Initialize disable_11ac flag properly by setting it to true in
mwifiex_fill_new_bss_desc().
Reported-by: NDoug Anderson <dianders@chromium.org>
Reviewed-by: NDoug Anderson <dianders@chromium.org>
Reviewed-by: NPaul Stewart <pstew@chromium.org>
Signed-off-by: NBing Zhao <bzhao@marvell.com>
Signed-off-by: NYogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>