ath_rx_tasklet() calls ath9k_rx_skb_preprocess() and ath9k_rx_skb_postprocess()
in a loop over the received frames. The decrypt_error flag is
initialized to false
just outside ath_rx_tasklet() loop. ath9k_rx_accept(), called by
ath9k_rx_skb_preprocess(),
only sets decrypt_error to true and never to false.
Then ath_rx_tasklet() calls ath9k_rx_skb_postprocess() and passes
decrypt_error to it.
So, after a decryption error, in ath9k_rx_skb_postprocess(), we can
have a leftover value
from another processed frame. In that case, the frame will not be marked with
RX_FLAG_DECRYPTED even if it is decrypted correctly.
When using CCMP encryption this issue can lead to connection stuck
because of CCMP
PN corruption and a waste of CPU time since mac80211 tries to decrypt an already
deciphered frame with ieee80211_aes_ccm_decrypt.
Fix the issue initializing decrypt_error flag at the begging of the
ath_rx_tasklet() loop.
Signed-off-by: NLorenzo Bianconi <lorenzo.bianconi83@gmail.com>
Cc: <stable@kernel.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

During suspend, the device will be moved to FULLSLEEP state.
As btcoex is never been stopped, the btcoex timer is running
and tries to access hw on fullsleep state. Fix that.

Cc: stable@vger.kernel.org
Signed-off-by: NRajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This return holds the number of bytes transfered (1 byte) or a negative
error code.  The type should be int instead of u8.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NPavel Roskin <proski@gnu.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Do not leak memory by updating pointer with potentially NULL realloc return value.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: NJussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

commit b74713d0
"ath9k: Handle fatal interrupts properly" introduced a race condition, where
IRQs are being left enabled, however the irq handler returns IRQ_HANDLED
while the reset is still queued without addressing the IRQ cause.
This leads to an IRQ storm that prevents the system from even getting to
the reset code.

Fix this by disabling IRQs in the handler without touching intr_ref_cnt.

Cc: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Cc: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NFelix Fietkau <nbd@openwrt.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

There's a bug that causes the rate scaling to get stuck
when it has to use single-stream rates with a peer that
can do GF and SGI; the two are incompatible so we can't
use them together, but that causes the algorithm to not
work at all, it always rejects updates.

Disable greenfield for now to prevent that problem.

Cc: stable@vger.kernel.org
Reviewed-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Tested-by: NCesar Eduardo Barros <cesarb@cesarb.net>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

We can not pass NULL libconf->conf->channel to rt61pci_config() as it
is dereferenced unconditionally in rt61pci_config_lna_gain() subroutine.

Resolves:
https://bugzilla.kernel.org/show_bug.cgi?id=44361

Cc: stable@vger.kernel.org
Reported-and-tested-by: <dolohow@gmail.com>
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

AR1111 is same as AR9485. The h/w
difference between them is quite insignificant,
Felix suggests only very few baseband features
may not be available in AR1111. The h/w code for
AR9485 is already present, so AR1111 should
work fine with the addition of its PID/VID.

Cc: stable@vger.kernel.org [2.6.39+]
Cc: Felix Bitterli <felixb@qca.qualcomm.com>
Reported-by: NTim Bentley <Tim.Bentley@Gmail.com>
Signed-off-by: NMohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Tested-by: NTim Bentley <Tim.Bentley@Gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

brcmsmac cannot call freq_reg_info() during channel changes as it does
not hold cfg80211_lock, and as a result it generates a lockdep warning.
freq_reg_info() is being used to determine whether OFDM is allowed on
the current channel, so we can avoid the errant call by using the new
IEEE80211_CHAN_NO_OFDM for this purpose instead.
Reported-by: NJosh Boyer <jwboyer@redhat.com>
Signed-off-by: NSeth Forshee <seth.forshee@canonical.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The if_sdio_card structure was never being freed, and neither
was the command structure used for association.
Signed-off-by: NDaniel Drake <dsd@laptop.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch is going to fix the resuming failed from S3/S4
for rt3290 chip.
Signed-off-by: NWoody Hung <Woody.Hung@mediatek.com>
Cc: Kevin Chou <kevin.chou@mediatek.com>
Signed-off-by: NChen, Chien-Chia <machen@suse.com>
Reviewed-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

On an OLPC XO-1.5 we have seen the following situation:
 - the system starts going into suspend
 - no wake params are set, so the mmc layer removes the card
 - during remove, we send a command to the card
 - that command fails, causing if_sdio's reset method to try and remove
   the mmc card in attempt to reset it
 - the mmc layer is not happy about being asked to remove a card that
   it is already removing, and the kernel crashes

While the MMC layer could possibly be taught to behave better here,
it also seems sensible for libertas not to try and reset a card if
we're in the process of removing it anyway.
Signed-off-by: NDaniel Drake <dsd@laptop.org>
Acked-by: NDan Williams <dcbw@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add some comments by the way
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

... only needed if it's been in descriptor table
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

info->control.sta and control.vif may only be dereferenced during the
drv_tx call otherwise could lead to use-after-free bugs.
Signed-off-by: NThomas Huehn <thomas@net.t-labs.tu-berlin.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NDuan Jiong <djduanjiong@gmail.com>

In some rare cases, the CMD_ROC completion may take over 1 second.
The timeout had earlier been increased to 1000ms (from 750ms), but it
is still not enoug.  Increase it to 1500ms.
Signed-off-by: NLuciano Coelho <coelho@ti.com>

We need to wait for the command completion event when we send the
CMD_ROLE_STOP event otherwise we may try to send CMD_ROLE_START too
soon and get out-of-sync with the firmware.

In some cases, the firmware may not send the event, so we wait for the
event or for the timeout, whichever comes first.

This patch is based on an earlier version by Eliad.

Cc: Eliad Peller <eliad@wizery.com>
Signed-off-by: NLuciano Coelho <coelho@ti.com>

Use this opportunity to consolidate the check for MIMO support into a
separate function.
Signed-off-by: NArik Nemtsov <arik@wizery.com>
Signed-off-by: NLuciano Coelho <coelho@ti.com>

handle errors of nla_put() inside the if(nla_put...) {}

This makes the code simpler and clearer because:
we take advantage from the fact that we have only one nla_put
in our routines (so no real need for goto label).
this avoids ugly goto forward followed by goto backward.
Signed-off-by: NYair Shapira <yair.shapira@ti.com>
Signed-off-by: NLuciano Coelho <coelho@ti.com>

this completes the calibrator based fem detect logic in driver:
driver starts (by calibrator) in plt_mode PLT_FEM_DETECT
wlcore inits and starts plt on wl12xx
wl12xx fetches fem number from firmware and stores it in wl->fem_manuf
wl12xx immediatly returns (doesn't start radio, etc...)
wlcore returns the fem_manuf to calibrator using WL1271_TM_ATTR_DATA
plt_mode is stopped
Signed-off-by: NYair Shapira <yair.shapira@ti.com>
Signed-off-by: NLuciano Coelho <coelho@ti.com>

bip calibration is not required in wl18xx. Therefore we
disable also auto fem (using calibrator fem detect) mode.
Signed-off-by: NYair Shapira <yair.shapira@ti.com>
Signed-off-by: NLuciano Coelho <coelho@ti.com>

add wl->plt_mode that is used to indicate different plt
working modes: this will be used to implement calibrator side
auto fem detection where driver asks firmware to detect
the wlan fem radio type and returns it to calibrator.

this is not implemented yet and plt_modes: PLT_ON and
PLT_FEM_DETECT currently behave the same.
Signed-off-by: NYair Shapira <yair.shapira@ti.com>
Signed-off-by: NLuciano Coelho <coelho@ti.com>

After the latest mac80211 changes, the sta has
the ap's sta pointer even before association.

This cause the auth and assoc frames to be sent
with the standard ap's rates, rather than the
basic rates.

Change the tx rate policy logic to use the regular
ap rates only for data packets (so control and mgmt
packets will be sent with basic rates)
Signed-off-by: NEliad Peller <eliad@wizery.com>
Signed-off-by: NLuciano Coelho <coelho@ti.com>

During interface removal, don't adjust sleep_auth if we are during
recovery. Since the FW is potentially dead we shouldn't talk to it.
Reported-by: NYossi Wortzel <yossiw@ti.com>
Signed-off-by: NArik Nemtsov <arik@wizery.com>
Signed-off-by: NLuciano Coelho <coelho@ti.com>

Initialize val to 0, to remove the following warning with
CONFIG_CC_OPTIMIZE_FOR_SIZE. The compiler used was gcc 4.4.1
(Sourcery G++ Lite 2010q1-202).

drivers/net/wireless/ti/wl18xx/io.c: In function 'wl18xx_top_reg_read':
drivers/net/wireless/ti/wl18xx/io.c:57: warning: 'val' may be used uninitialized in this function
Signed-off-by: NArik Nemtsov <arik@wizery.com>
Signed-off-by: NLuciano Coelho <coelho@ti.com>

Send EAPOLs using minimum basic rate for AP, STA, p2p GO and Client.
The patch fixes p2p connection issue with Realtek device in p2p
certification test 5.1.13 (DEVUT reinvokes Persistent Group).
Signed-off-by: NIgal Chernobelsky <igalc@ti.com>
Signed-off-by: NLuciano Coelho <coelho@ti.com>

ht_mode added to wl18xx conf struct in order to support different modes
from the configuration file, as well as module params, and by default
(working without a conf file and/or no module params).
the hack regarding conf.phy.low_band_component_type for each board
is now explicitly handled after parsing module params.
missing default values to wl18xx config added.
fix string module params not to have defaults (so if empty, param
can be taken from conf file).
update conf version to 3.
Signed-off-by: NYair Shapira <yair.shapira@ti.com>
Signed-off-by: NIdo Reis <idor@ti.com>
Signed-off-by: NLuciano Coelho <coelho@ti.com>

suspend and resume callbacks configure wakeup conditions to the FW
which may be different between suspend and resume.
This feature is currently not utilized as both in suspend and resume
FW wakeup every 1 DTIM. Avoid waking up the chip and doing the FW command
unless there's an actual difference in the wakeup conditions.
Signed-off-by: NEyal Shapira <eyal@wizery.com>
Signed-off-by: NLuciano Coelho <coelho@ti.com>

We get DMA alignment trouble if the beginning of the conf.phy struct is
not aligned to 4 bytes. Use kmemdup to ensure alignment.
Signed-off-by: NArik Nemtsov <arik@wizery.com>
Signed-off-by: NLuciano Coelho <coelho@ti.com>

b43 with open firmware crashes mac80211 because
it changes the number of queues at runtime which,
while it was never really supported, now crashes
mac80211 due to the new hardware queue logic.

Fix this by detecting open vs. proprietary fw
earlier and registering with mac80211 with the
right number of queues.
Tested-by: NStefan Lippers-Hollmann <s.l-h@gmx.de>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
Cc: stable@vger.kernel.org (depends on commit a6f38ac3)
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Using work_pending() to defer certain operations when
a HW-reset work has been queued is racy since the check
would return false when the work item is actually in
execution. Use SC_OP_HW_RESET instead to fix this race.
Also, unify the reset debug statistics maintenance.
Signed-off-by: NRajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When an interface in AP or P2P-GO mode is removed,
check whether a station interface is already present and
reconfigure the beacon timers etc. properly if it's
associated.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Currently, there are problems with how ANI is handled in
multi-VIF scenarios. This patch addresses them by unifying
the start/stop logic.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Remove unused variables, use a helper function to choose
the slot and reset beaconing status at one place.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Setup the beacon queue parameters after disabling
interrupts. Also, remove the redundant call in conf_tx()
for IBSS mode since the queue would be configured
with the appropriate cwmin/cwmax values when beaconing
is enabled.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In the tx_last_beacon() callback, mac80211's beaconing
status can be used instead. The beacon tasklet doesn't require
it because it is disabled when removing a slot.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

* The beaconing status routine is not required, since in
  multi-VIF cases the HW beacon parameters should not be
  re-configured.

* Remove SC_OP_TSF_RESET - when a beaconing interface comes
  up the first time, the TSF has to be reset.

* Simplify ath9k_allow_beacon_config().

* Handle setting/clearing the SWBA interrupt properly.

* Remove the TSF mangling in IBSS mode, it is not required.

* General code cleanup.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Cleanup the messy logic dealing with station association
and disassociation.
Signed-off-by: NSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>