The link_tuner() function will always call bbp_read()
at the start of the function. Because this is an
indirect register access has some costs attached
to it (especially for USB hardware).

We already store the value read from the register
into the vgc_level value inside the link structure.
Instead of reading from the register we can read that
field directly and base the tuner on that value.

This reduces the time the registers are locked with
the csr_mutex and speeds up the link_tuner processing.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Move link and antenna tuning into a seperate file named rt2x00link.c,
this makes the interface to the link tuner a lot cleaner.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Listen to IEEE80211_CONF_PS to determine if the device
should drop into powersaving mode. This feature depends
on the dynamic power save functionality in mac80211.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

On modern b43 devices with core rev >=3, the hardware guarantees us an
atomic 64bit read/write of the TSF, if we access the lower 32bits first.
Signed-off-by: NMichael Buesch <mb@bu3sch.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This fixes the key handling for mac80211's new key->flags.
It also adds TX locking to the set_key handler and adds a comment why this is required.
This doesn't fix any known bugs.
Signed-off-by: NMichael Buesch <mb@bu3sch.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The RTL8187 and RTL8187B devices can stall unless an explicit termination
packet is sent.
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In ieee80211_sta structure there is u64 supp_rates[IEEE80211_NUM_BANDS]
this is filled with all support rate from assoc_resp.  If we associate
with G-band AP only supp_rates of G-band will be set the other band
supp_rates will be set to 0. If the user type this command
this will cause mac80211 to set to new channel, mac80211
does not disassociate in setting new channel, so the active
band is now A-band. then in handling the new essid mac80211 will
kick in the assoc steps which involve sending disassociation frame.
in this mac80211 will WARN_ON sta->supp_rates[A_BAND] == 0.

This fixes:
http://www.intellinuxwireless.org/bugzilla/show_bug.cgi?id=1822
http://www.kerneloops.org/searchweek.php?search=rs_get_rateSigned-off-by: Nmohamed abbas <mohamed.abbas@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Artur Skawina confirmed that the first generation devices needs the same
URB_ZERO_PACKET flag, in oder to finish the pending transfer properly.
The second generation has been successfully fixed by
"p54usb: fix random traffic stalls (LM87)" (43af18f06d5)
Signed-off-by: NChristian Lamparter <chunkeey@web.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

be consistent with mac80211 drivers and return correct return code.
NETDEV_TX_OK is 0, but we need to be consistent wrt formatting amongst
implementations

re: http://marc.info/?l=linux-wireless&m=123119327419865&w=2Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Reviewed-by: NTomas Winkler <tomas.winkler@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Giuseppe Cala <jiveaxe@gmail.com> (The second "a" in "Cala" should be
a grave, U+00E0) reported success on zd1211-devs@lists.sourceforge.net.
The chip info is:
zd1211b chip 0df6:0036 v4810 high 00-0c-f6 AL2230_RF pa0 g--N-

The Sitecom WL-603 is detected as a zd1211b with a AL2230 RF transceiver chip.
Signed-off-by: NGiuseppe Cala <jiveaxe@gmail.com>
Signed-off-by: NHin-Tak Leung <htl10@users.sourceforge.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In theory, the firmware acks the received a data frame, before signaling the driver to free it again.
However Artur Skawina <art.08.09@gmail.com> has shown that it can happen in reverse order as well.
This is very bad and could lead to memory corruptions, oopses and panics.

Thanks to Artur Skawina <art.08.09@gmail.com> for reporting and debugging this issue.
Signed-off-by: NChristian Lamparter <chunkeey@web.de>
Tested-by: NArtur Skawina <art.08.09@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

If we let the firmware do the data encryption, we have to remove the ICV and
(M)MIC at the end of the frame before we can give it back to mac80211.
Or, these data frames have a few trailing bytes on cooked monitor interfaces.
Signed-off-by: NChristian Lamparter <chunkeey@web.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch fixes a obvious memory leak in the eeprom parser.
Signed-off-by: NChristian Lamparter <chunkeey@web.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

KERN_INFO is too "loud" for messages that are generated by the ordinary
events, such as accociation.  Use of KERN_DEBUG is consistent with
mac80211.

Suggested by Michael Gilbert <michael.s.gilbert@gmail.com>
Signed-off-by: NPavel Roskin <proski@gnu.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Mac80211 provides 2 structures to handle bitrates, namely
ieee80211_rate and ieee80211_tx_rate. To determine the short preamble
mode for an outgoing frame, the flag IEEE80211_TX_RC_USE_SHORT_PREAMBLE
must be checked on ieee80211_tx_rate and not ieee80211_rate (which rt2x00 did).

This fixes a regression which was triggered in 2.6.29-rcX as reported by Chris Clayton.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Tested-By: NChris Clayton <chris2553@googlemail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

[   56.923623] BUG: sleeping function called from invalid context at /home/bor/src/linux-git/mm/slub.c:1599
[   56.923644] in_atomic(): 0, irqs_disabled(): 1, pid: 3031, name: wpa_supplicant
[   56.923656] 2 locks held by wpa_supplicant/3031:
[   56.923662]  #0:  (rtnl_mutex){--..}, at: [<c02abd1f>] rtnl_lock+0xf/0x20
[   56.923703]  #1:  (&priv->lock){++..}, at: [<dfc840c2>] orinoco_ioctl_set_genie+0x52/0x130 [orinoco]
[   56.923782] irq event stamp: 910
[   56.923788] hardirqs last  enabled at (909): [<c01957db>] __kmalloc+0x7b/0x140
[   56.923820] hardirqs last disabled at (910): [<c0309419>] _spin_lock_irqsave+0x19/0x80
[   56.923847] softirqs last  enabled at (880): [<c0124f54>] __do_softirq+0xc4/0x110
[   56.923865] softirqs last disabled at (871): [<c01049ae>] do_softirq+0x8e/0xe0
[   56.923895] Pid: 3031, comm: wpa_supplicant Not tainted 2.6.29-rc2-1avb #1
[   56.923905] Call Trace:
[   56.923919]  [<c01049ae>] ? do_softirq+0x8e/0xe0
[   56.923941]  [<c011ad12>] __might_sleep+0xd2/0x100
[   56.923952]  [<c0195837>] __kmalloc+0xd7/0x140
[   56.923963]  [<c030946a>] ? _spin_lock_irqsave+0x6a/0x80
[   56.923981]  [<dfc840e9>] ? orinoco_ioctl_set_genie+0x79/0x130 [orinoco]
[   56.923999]  [<dfc840c2>] ? orinoco_ioctl_set_genie+0x52/0x130 [orinoco]
[   56.924017]  [<dfc840e9>] orinoco_ioctl_set_genie+0x79/0x130 [orinoco]
[   56.924036]  [<c0209325>] ? copy_from_user+0x35/0x130
[   56.924061]  [<c02ffd96>] ioctl_standard_call+0x196/0x380
[   56.924085]  [<c029f945>] ? __dev_get_by_name+0x85/0xb0
[   56.924096]  [<c02ff88f>] wext_handle_ioctl+0x14f/0x230
[   56.924113]  [<dfc84070>] ? orinoco_ioctl_set_genie+0x0/0x130 [orinoco]
[   56.924132]  [<c02a3da5>] dev_ioctl+0x495/0x570
[   56.924155]  [<c0293e05>] ? sys_sendto+0xa5/0xd0
[   56.924171]  [<c0142fe8>] ? mark_held_locks+0x48/0x90
[   56.924183]  [<c0292880>] ? sock_ioctl+0x0/0x280
[   56.924193]  [<c029297d>] sock_ioctl+0xfd/0x280
[   56.924203]  [<c0292880>] ? sock_ioctl+0x0/0x280
[   56.924235]  [<c01a51d0>] vfs_ioctl+0x20/0x80
[   56.924246]  [<c01a53e2>] do_vfs_ioctl+0x72/0x570
[   56.924257]  [<c0293e62>] ? sys_send+0x32/0x40
[   56.924268]  [<c02947c0>] ? sys_socketcall+0x1d0/0x2a0
[   56.924280]  [<c010339f>] ? sysenter_exit+0xf/0x16
[   56.924292]  [<c01a5919>] sys_ioctl+0x39/0x70
[   56.924302]  [<c0103371>] sysenter_do_call+0x12/0x31
Signed-off-by: NAndrey Borzenkov <arvidjaar@mail.ru>
Cc: stable@kernel.org
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NJan Engelhardt <jengelh@medozas.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Improve usbnet's devdbg to always type-check diagnostic arguments,
like dev_dbg (device.h).  This makes no change to the resulting size of
usbnet modules.

This patch also removes an #ifdef DEBUG directive from rndis_wlan so
it's devdbg statements are always type-checked at compile time.
Signed-off-by: NSteve Glendinning <steve.glendinning@smsc.com>
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

p54 doesn't support AES-128-CMAC offload.

This patch will fix the noisy mac80211 warnings, when 802.11w is enabled:
mac80211-phy189: failed to set key (4, ff:ff:ff:ff:ff:ff) to hardware (-22)
mac80211-phy189: failed to set key (5, ff:ff:ff:ff:ff:ff) to hardware (-22)
Signed-off-by: NChristian Lamparter <chunkeey@web.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Fix for:

BUG: scheduling while atomic: named/2004/0x10000200
Pid: 2004, comm: named Not tainted 2.6.29-rc1-00271-ge9fa6b0 #45
Call Trace:
 [<c04d4ef7>] schedule+0x2a7/0x320
 [<c03aed74>] __alloc_skb+0x34/0x110
 [<c011f5b3>] __cond_resched+0x13/0x30
 [<c04d501d>] _cond_resched+0x2d/0x40
 [<c016d8c5>] kmem_cache_alloc+0x95/0xc0
 [<c016b8d4>] check_object+0xc4/0x230
 [<c03aed74>] __alloc_skb+0x34/0x110
 [<c02ede91>] p54_alloc_skb+0x71/0xf0
 [<c02ee36f>] p54_set_tim+0x3f/0xa0
 [<c04ae064>] sta_info_set_tim_bit+0x64/0x80
 [<c04c1017>] invoke_tx_handlers+0xd57/0xd80
 [<c016c397>] free_debug_processing+0x197/0x210
 [<c03ae215>] pskb_expand_head+0xf5/0x170
 [<c04bfd94>] __ieee80211_tx_prepare+0x164/0x2f0
 [<c04c1a8d>] ieee80211_skb_resize+0x6d/0xe0
 [<c04c250f>] ieee80211_master_start_xmit+0x23f/0x550
 [<c016d188>] __slab_alloc+0x2b8/0x4f0
 [<c013a711>] getnstimeofday+0x51/0x120
 [<c03b5e7b>] dev_hard_start_xmit+0x1db/0x240
 [<c03c6a4b>] __qdisc_run+0x1ab/0x200
 [<c0136aa1>] __run_hrtimer+0x31/0xf0
 [<c03b6247>] dev_queue_xmit+0x247/0x500
 [<c04c1e56>] ieee80211_subif_start_xmit+0x356/0x7d0
 [<c0466ff7>] packet_rcv_spkt+0x37/0x150
 [<c0466ff7>] packet_rcv_spkt+0x37/0x150
 [<c03b5e7b>] dev_hard_start_xmit+0x1db/0x240
 [<c03c6a4b>] __qdisc_run+0x1ab/0x200
 [<c03b6247>] dev_queue_xmit+0x247/0x500
 [<c03bc1e2>] neigh_resolve_output+0xe2/0x200
 [<c0410080>] ip_finish_output+0x0/0x290
 [<c0410267>] ip_finish_output+0x1e7/0x290
 [<c040f355>] ip_local_out+0x15/0x20
 [<c040f5d2>] ip_push_pending_frames+0x272/0x380
 [<c042bbc6>] udp_push_pending_frames+0x146/0x3a0
 [<c042d52a>] udp_sendmsg+0x2fa/0x6b0
 [<c0433bc7>] inet_sendmsg+0x37/0x70
 [<c03a7b7e>] sock_sendmsg+0xbe/0x100
 [<c0133cd0>] autoremove_wake_function+0x0/0x50
 [<c011c043>] __wake_up_common+0x43/0x70
 [<c024a892>] copy_from_user+0x32/0x130
 [<c024a892>] copy_from_user+0x32/0x130
 [<c03b001e>] verify_iovec+0x2e/0xb0
 [<c03a7d3f>] sys_sendmsg+0x17f/0x290
 [<c017730a>] pipe_write+0x29a/0x570
 [<c013a172>] update_wall_time+0x492/0x8e0
 [<c013a711>] getnstimeofday+0x51/0x120
 [<c011b05d>] sched_slice+0x3d/0x80
 [<c013a711>] getnstimeofday+0x51/0x120
 [<c0136657>] hrtimer_forward+0x147/0x1a0
 [<c01101b0>] lapic_next_event+0x10/0x20
 [<c013ccb3>] clockevents_program_event+0xa3/0x170
 [<c03a9054>] sys_socketcall+0xa4/0x290
 [<c0110920>] smp_apic_timer_interrupt+0x40/0x70
 [<c0103165>] sysenter_do_call+0x12/0x25
Signed-off-by: NArtur Skawina <art.08.09@gmail.com>
Acked-by: NChristian Lamparter <chunkeey@web.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When running modprobe rt73usb, and then rmmod rt73usb, and then
iwconfig, the wlan0 device does not disappear. When repeating this
process again, we get a kernel Oops errors and "BUG: unable to handle
kernel paging request..." message in the kernel log.

The reason for this is that there is an error in rt2x00rfkill_free(),
which is called in the process of removing the device
(rt2x00lib_remove_dev() in rt2x00dev.c).
rt2x00rfkill_free() clears the RFKILL_STATE_ALLOCATED bit , which is
bit number 1 () in rt2x00dev->flags instead of in
rt2x00dev->rfkill_state. As a result, when checking the
DEVICE_STATE_REGISTERED_HW bit (bit number 1 in rt2x00dev->flags) in
rt2x00lib_remove_hw() it is **unset**, and we wrongly **don't** call
ieee80211_unregister_hw().

This patch corrects this: the parameter for __test_and_clear_bit() in
rt2x00rfkill_free() should be &rt2x00dev->rfkill_state and not
&rt2x00dev->flags.
Signed-off-by: NRami Rosen <ramirose@gmail.com>
Acked-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In function iwl_send_cmd_sync(), if the flag CMD_WANT_SKB is set but
we are not provided with a valid SKB (cmd->meta.u.skb == NULL), we need
to remove the CMD_WANT_SKB flag from the TX cmd queue. Otherwise in case
the cmd comes in later, it will possibly set an invalid address. Thus
it causes an invalid memory access.

This fixed the bug http://bugzilla.kernel.org/show_bug.cgi?id=11326.
Signed-off-by: NZhu Yi <yi.zhu@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Incorrect operator causes the REG_DOMAIN_2GHZ_MASK to be zero which
surely was not the goal of this definition. Mask out the 11a flags
correctly.
Signed-off-by: NJouni Malinen <jouni.malinen@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This was not supposed to be a bitwise AND operation, but a check of
two separate conditions. Anyway, the old code happened to result in
the same behavior, so this is just changing the code to be easier to
understand and also to keep sparse from warning about dubious
operators.
Signed-off-by: NJouni Malinen <jouni.malinen@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Data structures that come over the wire from the WLAN firmware must be packed.
This fixes alignment problems on the blackfin architecture and, reportedly, on
the AVR32.

This is a replacement for the previous version of this patch which had also
explicitly used get_unaligned_ macros.  As Johannes Berg pointed out, these
macros were unnecessary.
Signed-off-by: NAndrey Yurovsky <andrey@cozybit.com>
Signed-off-by: NColin McCabe <colin@cozybit.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch fixes a bug that could occur, if it the eeprom is incomplete or partly corrupted.

BUG: unable to handle kernel NULL pointer dereference at 00000008
IP: p54_assign_address+0x108/0x15d [p54common]
Oops: 0002 [#1] SMP
Pid: 12988, comm: phy1 Tainted: P        W  2.6.28-rc6-wl #3
RIP: 0010: p54_assign_address+0x108/0x15d [p54common]
 [...]
Call Trace:
 p54_alloc_skb+0xa3/0xc0 [p54common]
 p54_scan+0x37/0x204 [p54common]
 [...]
Signed-off-by: NChristian Lamparter <chunkeey@web.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

drivers/net/wireless/p54/p54common.c: In function ‘p54_config’:
drivers/net/wireless/p54/p54common.c:1853: warning: ‘ret’ may be used uninitialized in this function
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

drivers/net/wireless/iwlwifi/iwl-3945.c: In function ‘iwl3945_txpower_set_from_eeprom’:
drivers/net/wireless/iwlwifi/iwl-3945.c:2222: warning: ‘power_idx’ may be used uninitialized in this function
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

drivers/net/wireless/b43legacy/main.c: In function ‘b43legacy_op_dev_config’:
drivers/net/wireless/b43legacy/main.c:2468: warning: ‘up_dev’ may be used uninitialized in this function
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

drivers/net/wireless/b43/main.c: In function ‘b43_op_config’:
drivers/net/wireless/b43/main.c:3264: warning: ‘gmode’ may be used uninitialized
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The TX op should return NETDEV_TX_OK or NETDEV_TX_BUSY.
Signed-off-by: NAndrey Yurovsky <andrey@cozybit.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The TXD_W0_CIPHER field is a 1-bit field. It only acts as boolean value
to indicate if the frame must be encrypted or not.

The way rt2x00_set_field32() worked it would grab the least signifcant bit
from txdesc->cipher and use that as value. Because of that WEP 64 and TKIP
worked since they had odd-numbered values, while WEP 128 and AES were
even numbers and didn't work.

Correctly booleanize the txdecs->cipher value to allow the hardware to
encrypt the outgoing data. After this we can enable HW crypto by default again.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Should return NETDEV_TX_{OK,BUSY} instead of 0,-1 (this doesn't change
any current functionality).

Changes-licensed-under: 3-Clause-BSD
Reported-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NBob Copeland <me@bobcopeland.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Due to misunderstanding of the returned values allowed for the tx callback
of mac80211, rtl8187 was using skb's that had been freed. This problem was
triggered when the module was sujected to a rmmod/insmod cycle.

After that was fixed, the modules would not work after the rmmod/insmod cycle
until the USB device was reset.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch hopefully fixes a mac80211<->p54 interaction problem, which was
described by Larry Finger (ref: http://marc.info/?l=linux-wireless&m=123009889327707 )

I guess the warning was triggered by pending frames in the receive queue,
while we're doing a band change 5GHz.
Signed-off-by: NChristian Lamparter <chunkeey@web.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This corrects usage of AR5K_CFG_ADHOC introduced in
"ath5k: Update PCU code". Also,
the name of the indicator is changed to AR5K_CFG_IBSS to more
accurately reflect its function. This change restores
beaconing in AP and mesh modes.
Signed-off-by: NSteve Brown <sbrown@cortland.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch reverts "ath9k: Fix TX status reporting for retries and MCS index"
because that change ended up breaking ath9k rate control. While the
MCS index reporting to mac80211 was indeed fixed by the patch, it did
not take into account that the ath9k rate control algorithm was
updating private tables based on this index and the index comes
through the rate control API call, i.e., based on mac80211 TX status
call. In addition, it looks like the "fix" to remove +1 from TX status
'count' field was not correct based on ieee80211_tx_status()
implementation that counts the total of count values, but starting
from -1, not 0.

The TX status reporting for frames using MCS needs to be fixed
somehow, but it does not look like there is any easy fix for the ath9k
rate control algorithm, so the best option now seems to be to revert the
change and bring it back once the rate control code is cleaned up to
handle this better.
Signed-off-by: NJouni Malinen <jouni.malinen@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch fixes an issue with the sequence numbers of unaggregated
QoS frames, because of which the frames are handled in a different order
at the AP and resulted in MLME REPLAYFAILURE.
Signed-off-by: NSenthil Balasubramanian <senthilkumar@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

rt2500usb doesn't strip the IV/ICV data from received frames,
so we don't need to set the RX_FLAG_IV_STRIPPED flag.
We do need to set the RX_FLAG_MMIC_STRIPPED flag for all
encryption types since the MMIC has been removed from the frame.

After this patch TKIP Hardware crypto works for rt2500usb.
WEP and AES are still failing.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

To be compatible with mac80211 following "mac80211: only create
default STA interface if supported", rtl8180 needs to set
NL80211_IFTYPE_STATION in interface_modes.
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Reported-by: NFabio Rossi <rossi.f@inwind.it>
Tested-by: NPiter PUNK <piterpunk@unitednerds.org>
Acked-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>